CVE-2026-98966
kernel: bonding: fix the program leak when XDP is replaced
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 23, 2026
Updated · October 29, 2026
Description
A flaw was found in the Linux kernel's network bonding driver. This vulnerability can lead to a Denial of Service (DoS) caused by kernel memory exhaustion when updating network filters. Because the driver fails to release the reference to an existing eXpress Data Path (XDP) program when a new program is attached, a local privileged user can repeatedly replace programs to leak memory and exhaust system resources.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 2.3CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
CWE-911 · Improper Update of Reference Count