CVE-2026-98089

A flaw was found in the Linux kernel's network bonding driver. When transmitting or forwarding network packets in adaptive load balancing mode, the system fails to properly initialize header pointers before inspecting network traffic. An attacker transmitting packets through an affected interface can trigger an out-of-bounds memory read, resulting in a Denial of Service (DoS) caused by a kernel crash.

This vulnerability is rated as Moderate impact because triggering it requires local packet transmission privileges and only affects configurations utilizing the balance-alb bonding mode. In standard Red Hat Enterprise Linux installations, bonding interfaces are not configured by default. Even when bonding is deployed, exploitation is restricted to inducing a kernel crash, causing a denial of service without exposing or modifying system data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.