CVE-2026-31419
Use-After-Free in Linux Kernel Bonding Causes Potential Crash
Publication date: 2026-04-13
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
| linux | linux_kernel | 7.0.0-rc3+ |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free (UAF) issue in the Linux kernel's network bonding driver, specifically in the function bond_xmit_broadcast().
The function reuses a network buffer (skb) for the last slave device and clones it for others. However, if the list of slave devices changes concurrently during this process, the determination of which slave is last can become incorrect.
This race condition causes the original skb to be double-consumed or double-freed, leading to a use-after-free error that can crash the kernel.
The fix replaces the unstable check for the last slave with a stable index comparison against a pre-snapshot count of slaves, preventing the double-free while preserving performance optimizations.
How can this vulnerability impact me? :
This vulnerability can cause a kernel crash due to a use-after-free error in the network bonding driver.
Such crashes can lead to denial of service (DoS) conditions, making the affected system unstable or unavailable.
In some cases, use-after-free vulnerabilities can be exploited to execute arbitrary code or escalate privileges, but this specific CVE description does not confirm such exploitation beyond causing crashes.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a use-after-free (UAF) error in the Linux kernel bonding driver, which can cause kernel crashes with KASAN (Kernel Address Sanitizer) reports indicating slab-use-after-free in skb_clone.
Detection would typically involve monitoring kernel logs for crash reports similar to the one described, including messages about KASAN slab-use-after-free errors related to skb_clone and bond_xmit_broadcast.
Since no specific detection commands or tools are provided, general commands to check kernel logs and dmesg for related errors include:
- dmesg | grep -i 'bond_xmit_broadcast'
- journalctl -k | grep -i 'KASAN'
- journalctl -k | grep -i 'use-after-free'
Additionally, enabling KASAN or other kernel debugging features may help detect this issue during testing or development.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been fixed by replacing the racy bond_is_last_slave() check with a stable index comparison to prevent use-after-free conditions.
Immediate mitigation steps include updating the Linux kernel to a version that contains this fix (post 7.0.0-rc3+ where the patch is applied).
If updating the kernel is not immediately possible, consider disabling bonding or avoiding configurations that trigger bond_xmit_broadcast() until a patched kernel is deployed.