CVE-2026-23451

A flaw was found in the Linux kernel's bonding component. When a specific network configuration involving a stack of two bonding devices is set up, the bond_header_parse() function can enter an infinite loop. This vulnerability can lead to a Denial of Service (DoS), making the affected system unresponsive.

A MODERATE denial-of-service flaw was found in the Linux kernel bonding driver. When two bonding devices are stacked (one bonding device configured on top of another), the bond_header_parse() function can enter an infinite loop, because skb->dev always points to the top of the device hierarchy, so the header-parse recursion never reaches the leaf device's parse method. This stalls packet processing and can make the affected system unresponsive or consume excessive CPU. Red Hat assessed this flaw as MODERATE (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) with a local attack vector, because exploitation requires a system already configured with the non-standard stacked bonding setup; this differs from the upstream CVEORG rating of 7.5 with a network attack vector. The vulnerable code is not present in the kernels shipped in supported Red Hat Enterprise Linux releases and Red Hat In-Vehicle OS, so those products are not affected. The only affected record is the kernel in Red Hat Enterprise Linux 6 Extended Life Cycle Support, which is out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This flaw can only be triggered in a stacked bonding configuration, so avoiding configurations in which one bonding device is layered on top of another bonding device prevents the infinite loop in bond_header_parse(). No supported Red Hat Enterprise Linux or Red Hat In-Vehicle OS releases contain the vulnerable code, so no update is required for those products. For the out-of-support-scope Red Hat Enterprise Linux 6 ELS kernel, no fix is planned; upgrading to a supported Red Hat Enterprise Linux release is the available remediation.