Most recent entries from all

CVE-2026-23171 — bonding: fix use-after-free due to enslave fail after slave array update

2026-10-08T18:36:50.708526+00:00

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

bonding: fix use-after-free due to enslave fail after slave array update

Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be used for Tx immediately, we can use it after it has been freed by the enslave error cleanup path which frees the allocated slave memory. Slave update array is supposed to be called last when further enslave failures are not expected. Move it after xdp setup to avoid any problems.

It is very easy to reproduce the problem with a simple xdp_pass prog: ip l add bond1 type bond mode balance-xor ip l set bond1 up ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass ip l add dumdum type dummy

Then run in parallel: while :; do ip l set dumdum master bond1 1>/dev/null 2>&1; done; mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp "dp=1-1023, flags=syn"

The crash happens almost immediately: [ 605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI [ 605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf] [ 605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G B 6.19.0-rc6+ #21 PREEMPT(voluntary) [ 605.602979] Tainted: [B]=BAD_PAGE [ 605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 6…

RHSA-2026:10108 — Red Hat Security Advisory: kernel security update

2026-10-08T18:36:50.708620+00:00

kernel: Bluetooth: MGMT: Fix possible UAFs kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats kernel: Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check kernel: Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() kernel: net/sched: cls_u32: use skb_header_pointer_careful() kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain() kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

RHSA-2026:6153 — Red Hat Security Advisory: kernel security update

2026-10-08T18:36:50.708664+00:00

kernel: Linux kernel: Use-After-Free vulnerability in ATM subsystem kernel: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies kernel: Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution kernel: ALSA: aloop: Fix racy access at PCM trigger kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() kernel: net/sched: cls_u32: use skb_header_pointer_careful() kernel: macvlan: fix error recovery in macvlan_common_newlink()