CVE-2026-43441
NULL dereference in Linux Kernel bonding driver
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's network bonding driver. When IPv6 is disabled using the 'ipv6.disable=1' boot parameter, a critical data structure called nd_tbl is never initialized. If bonding ARP/NS validation is enabled, receiving an IPv6 Neighbor Solicitation or Neighbor Advertisement packet on a bonded slave interface can trigger a function call path that leads to a NULL pointer dereference and kernel crash.
Specifically, the issue arises because the function bond_validate_na() calls bond_has_this_ip6(), which calls ipv6_chk_addr(), eventually crashing in __ipv6_chk_addr_and_flags() due to the uninitialized nd_tbl. The fix involves checking if IPv6 is enabled before processing IPv6 packets in the bonding driver and returning early if IPv6 is disabled to avoid the crash.
How can this vulnerability impact me? :
This vulnerability can cause a kernel NULL pointer dereference leading to a system crash (kernel panic) when IPv6 is disabled and bonding ARP/NS validation is enabled. This can result in denial of service (DoS) conditions on affected systems, potentially causing unexpected reboots or downtime.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a kernel NULL pointer dereference crash when IPv6 is disabled and bonding ARP/NS validation is enabled. Detection involves monitoring for kernel crash logs or oops messages indicating a NULL pointer dereference in __ipv6_chk_addr_and_flags or related bonding functions.
You can check your kernel logs for crash messages similar to the following pattern: "BUG: kernel NULL pointer dereference" or "Oops: 0000 [#1] SMP NOPTI" with call traces involving bond_validate_na, bond_rcv_validate, or __ipv6_chk_addr_and_flags.
To detect if your system is vulnerable, verify if the kernel is running with the 'ipv6.disable=1' boot parameter and if bonding ARP/NS validation is enabled.
- Check kernel boot parameters: `cat /proc/cmdline | grep ipv6.disable`
- Check if bonding is enabled and ARP/NS validation is active by inspecting bonding interface settings, e.g., `cat /proc/net/bonding/bond0`
- Monitor kernel logs for crashes: `dmesg | grep -i 'NULL pointer dereference'` or `journalctl -k | grep -i 'bond_validate_na'`
What immediate steps should I take to mitigate this vulnerability?
This vulnerability occurs when the Linux kernel is booted with the 'ipv6.disable=1' parameter and bonding ARP/NS validation is enabled, which can cause a kernel NULL pointer dereference crash.
To mitigate this vulnerability immediately, avoid booting the system with the 'ipv6.disable=1' parameter if bonding ARP/NS validation is required.
Alternatively, update the Linux kernel to a version where this issue is fixed by checking ipv6_mod_enabled() before dispatching IPv6 packets to bond_na_rcv(), which prevents the crash.