CVE-2026-98074

A flaw was found in the Linux kernel's network bonding driver. A local user with network administration privileges can cause a physical network adapter to permanently remain in promiscuous mode (a configuration where an interface captures all traffic on the local network segment, rather than only traffic intended for it). During the teardown of a bonded network interface, the kernel prematurely clears tracking state for the active adapter before secondary interfaces are fully released. This prevents the driver from properly resetting the promiscuity counter, leaving the underlying physical device stuck in promiscuous mode.

A low impact flaw was found in the Linux kernel's network bonding driver, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases that ship Red Hat Enterprise Linux CoreOS; the corresponding Red Hat Enterprise Linux 6 Extended Lifecycle Support component is out of support scope. When a bonding interface is destroyed, __bond_release_one() unconditionally clears the current active slave pointer while releasing all slaves. If a backup slave is released before the active slave, the bonding driver's ALB handling increments the active physical device's promiscuity counter, and the subsequent release of the active slave skips the code path that would decrement it, permanently leaving the underlying physical network adapter in promiscuous mode after bond teardown. A local user with network administration privileges (CAP_NET_ADMIN) can trigger this issue by tearing down a bonding interface; an adapter left in promiscuous mode receives all traffic on the local network segment rather than only traffic intended for it. The flaw does not disrupt network device operation, crash the kernel, or allow modification of network traffic. Although the CVSS:3.1 base score is moderate (5.5), Red Hat rates the overall impact of this flaw as low, because exploitation requires local network administration privileges and observing the leaked traffic in practice additionally requires local packet-capture privileges. Due to the low impact and limited exposure, the fix for the affected Red Hat products is currently deferred; the residual risk is that a privileged local user could leave a physical interface in promiscuous mode after a bond is destroyed, weakening traffic isolation on the local network segment until the deferred fix is delivered.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.