CVE-2026-23171

A flaw was found in the Linux kernel's bonding module. This use-after-free vulnerability occurs when a new slave device is added to the bonding array but fails during the enslave process. A local attacker can exploit this by triggering the enslave failure, which may lead to a system crash, resulting in a Denial of Service (DoS), or potentially allow for arbitrary code execution.

This vulnerability is rated as having a Moderate impact because exploiting it requires local administrative privileges (such as CAP_NET_ADMIN) to manage network bonding configurations. An attacker must trigger an interface enslavement failure while simultaneously transmitting network traffic over the target bond, limiting exploitability to specific and uncommon operational scenarios. While the resulting memory corruption can cause a kernel crash and denial of service, exploitation cannot be performed by unprivileged remote actors.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the bonding kernel module from loading if bonding interfaces are not required. This can be achieved by creating a modprobe configuration file.

Create a file named /etc/modprobe.d/disable-bonding.conf with the following content: install bonding /bin/true

After creating the file, a system reboot is required for the change to take effect if the module is currently loaded. This action will prevent the creation and use of bonding network interfaces.