CVE-2026-98089
Received Received - Intake

Uninitialized Transport Header Access in Linux Kernel Bonding

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix uninitialized transport header access in alb_determine_nd() alb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers. However, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets or forwarded packets), skb->transport_header is not guaranteed to be initialized. While pskb_network_may_pull() ensures the packet data is linear starting from the network header, it does not set or adjust the transport header offset. Dereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory. Fetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(), and reload ipv6hdr in case pskb_may_pull() reallocated skb->head. Also remove the unused bond argument from alb_determine_nd().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98089
EUVD
EUVD-2026-86919

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the bonding driver's ALB (Adaptive Load Balancing) mode. The function alb_determine_nd() incorrectly accesses ICMPv6 headers without ensuring the transport header is properly initialized. This can lead to out-of-bounds memory access when processing packets sent via raw sockets or forwarded packets.

Detection Guidance

This vulnerability affects the Linux kernel's bonding driver (ALB mode) and involves uninitialized transport header access. Detection requires checking kernel logs for related errors or examining kernel code paths involving bonding and ICMPv6 handling. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service or potentially execute arbitrary code on affected systems. It primarily affects systems using the bonding driver with ALB mode enabled and processing IPv6 traffic.

Mitigation Strategies

Apply the kernel patch that fixes the uninitialized transport header access in alb_determine_nd(). Update to a patched version of the Linux kernel. Monitor kernel logs for errors related to bonding or ICMPv6 processing after applying the patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98089. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart