CVE-2026-74726
Received Received - Intake

Race Condition in Linux Kernel Bonding ALB Leads to Kernel Panic

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing the promiscuity it set on the active slave. In that window the active slave can change under RTNL (RTM_DELLINK -> __bond_release_one() -> bond_alb_handle_active_change()), which already drops the promiscuity and clears primary_is_promisc. The monitor still acts on the stale decision: if the slave was removed with no failover, curr_active_slave is now NULL and the deref faults; if it failed over, the stale dev_set_promiscuity(-1) underflows the new slave's promiscuity counter and pins it in IFF_PROMISC. Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: b42 bond_alb_monitor RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) Kernel panic - not syncing: Fatal exception Re-check primary_is_promisc (and curr_active_slave) after taking RTNL so the monitor only undoes an increment it still owns. The other bonding monitors already re-read state under RTNL in their commit phase (bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only one acting on the pre-trylock decision.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74726
EUVD
EUVD-2026-64413

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the bonding driver's ALB (Adaptive Load Balancing) mode. The issue occurs in bond_alb_monitor() where it reads primary_is_promisc under RCU lock, then drops RCU and takes RTNL via rtnl_trylock(). During this window, the active slave can change under RTNL, leading to a stale decision where the monitor acts on outdated information. This can cause a null pointer dereference or promiscuity counter underflow.

Detection Guidance

This vulnerability affects the Linux kernel's bonding driver (bond_alb_monitor). Detection requires checking kernel logs for general protection faults or null-ptr-deref errors related to bonding or bond_alb_monitor. Use commands like dmesg | grep -i 'bond_alb_monitor' or journalctl -k | grep -i 'bonding' to inspect kernel logs for suspicious activity.

Impact Analysis

This vulnerability can cause kernel crashes (oops) or kernel panics due to null pointer dereference or promiscuity counter underflow. It may lead to system instability, denial of service, or potential security issues if the bonding interface fails to operate correctly.

Mitigation Strategies

Apply the latest Linux kernel patches to resolve the bonding driver issue. If immediate patching is not possible, consider disabling the bonding driver's ALB (Adaptive Load Balancing) feature by setting the module parameter 'mode' to a non-ALB mode (e.g., mode=0 for round-robin). Monitor system stability and kernel logs for any signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74726. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart