Skip to content
Heist/ feed
Unrated

bonding: annotate data-races around slave->last_rx

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: bonding: annotate data-races around slave->last_rx slave->last_rx and slave->target_last_arp_rx[...] can be read and written locklessly. Add READ_ONCE() and WRITE_ONCE() annotations. syzbot reported: BUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1: bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335 bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533 __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039 __netif_receive_skb_one_core net/core/dev.c:6150 [inline] __netif_receive_skb+0x59/0x270 net/core/dev.c:6265 netif_receive_skb_internal net/core/dev.c:6351 [inline] netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410 ... write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 0: bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335 bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533 __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039 __netif_receive_skb_one_core net/core/dev.c:6150 [inline] __netif_receive_skb+0x59/0x270 net/core/dev.c:6265 netif_receive_skb_internal net/core/dev.c:6351 [inline] netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410 br_netif_receive_skb net/bridge/br_input.c:30 [inline] NF_HOOK include/linux/netfilter.h:318 [inline] ... value changed: 0x0000000100005365 -> 0x0000000100005366

Announced Source revision 1
Original source ↗

CVE-2026-23212

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-23212

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "f5b2b966f032f22d3a289045a5afd4afa09f09c6",
        "lessThan": "a7516cb0165926d308187e231ccd330e5e3ebff7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f5b2b966f032f22d3a289045a5afd4afa09f09c6",
        "lessThan": "8c0be3277e7aefb2f900fc37ca3fe7df362e26f5",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f5b2b966f032f22d3a289045a5afd4afa09f09c6",
        "lessThan": "b956289b83887e0a306067b6003c3fcd81bfdf84",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f5b2b966f032f22d3a289045a5afd4afa09f09c6",
        "lessThan": "bd98324e327e41de04b13e372cc16f73150df254",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f5b2b966f032f22d3a289045a5afd4afa09f09c6",
        "lessThan": "f6c3665b6dc53c3ab7d31b585446a953a74340ef",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/net/bonding/bond_main.c",
      "drivers/net/bonding/bond_options.c",
      "include/net/bonding.h"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "2.6.19"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "2.6.19",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.1.162",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.123",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.69",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.9",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "6.19",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/net/bonding/bond_main.c",
      "drivers/net/bonding/bond_options.c",
      "include/net/bonding.h"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-23212

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#39820 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement