CVE-2026-45970

A flaw was found in the Linux kernel's bonding driver, specifically within the Active-Backup Load Balancing (ALB) receive path. A local attacker can trigger a Use-After-Free (UAF) vulnerability in the rlb_arp_recv function by rapidly bringing a bond interface up and down while receiving Address Resolution Protocol (ARP) messages. This concurrent access to freed memory can lead to a null pointer dereference, resulting in a system crash and a Denial of Service (DoS).

This vulnerability is rated as Moderate severity because exploitation requires specific preconditions, notably an active bonding interface configured in Adaptive Load Balancing (ALB) mode, alongside administrative privileges to repeatedly toggle the interface state. Under default Red Hat Enterprise Linux installations, network bonding is not enabled unless explicitly configured by an administrator. Additionally, triggering the race condition requires incoming ARP traffic precisely timed with interface status transitions, primarily resulting in a local denial of service via a kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.