CVE-2026-98074

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bonding: do not clear curr_active_slave prematurely when releasing all slaves

When releasing all slaves during bond destruction (all == true),

__bond_release_one() unconditionally clears bond->curr_active_slave to

NULL in every iteration.

If a backup slave is released before the active slave,

bond_alb_deinit_slave() triggers rlb_teach_disabled_mac_on_primary(),

which increments the active slave dev promiscuity counter and sets

bond_info->primary_is_promisc = 1.

Because bond->curr_active_slave was prematurely cleared to NULL when

releasing the backup slave, the subsequent iteration releasing the active

slave evaluates oldcurrent as NULL, so bond_change_active_slave(bond, NULL)

is skipped. Consequently, bond_alb_handle_active_change() is never called

to decrement the promiscuity counter, permanently leaking promiscuous

mode on the physical device after bond teardown.

When oldcurrent == slave, bond_change_active_slav

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References