CVE-2026-43456
Kernel panic due to type confusion in Linux bonding driver
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can cause kernel crashes due to type confusion when certain network devices are bonded together improperly. Such crashes can lead to system instability, denial of service, and potential disruption of network connectivity on affected Linux systems.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing kernel crashes related to type confusion in the bonding driver, specifically involving the bond_setup_by_slave() function.
A practical way to detect the issue is by adding debug print statements (printk) in the ipgre_header() function and running a sequence of commands that create and configure dummy, GRE, and bond network interfaces.
- ip link add dummy0 type dummy
- ip addr add 10.0.0.1/24 dev dummy0
- ip link set dummy0 up
- ip link add gre1 type gre local 10.0.0.1
- ip link add bond1 type bond mode active-backup
- ip link set gre1 master bond1
- ip link set gre1 up
- ip link set bond1 up
- ip addr add fe80::1/64 dev bond1
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's bonding driver, specifically in the function bond_setup_by_slave(). When a non-Ethernet device such as a GRE tunnel is enslaved to a bond device, the bonding driver incorrectly copies the slave device's header operations (header_ops) directly to the bond device. This causes a type confusion issue because functions like dev_hard_header() and ipgre_header() expect the device-specific private data (netdev_priv) to be of a certain type, but instead receive the bonding device's private data structure. This mismatch leads to reading invalid data and results in kernel crashes.
The root cause is that the bonding driver blindly inherits header_ops from the slave device without considering that these callbacks expect a specific private data layout. The fix involves introducing wrapper functions (bond_header_ops) that delegate calls to the active slave's header_ops using the slave's own device, ensuring the correct private data is accessed.