CVE-2026-23119

A flaw was found in the Linux kernel's network bonding driver. When performing XDP redirect operations through a bonding interface, the bond_flow_dissect() function fails to provide a network namespace pointer to __skb_flow_dissect(). This triggers a kernel warning when processing packets with incomplete socket buffer metadata, potentially indicating improper state handling.

Triggering this flaw requires BPF capabilities (CAP_BPF or CAP_SYS_ADMIN) to run XDP programs via the bpf() syscall test interface. The impact is limited to a kernel warning rather than a crash or memory corruption, reducing the severity of this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.