PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23099 Linux kernel CVE debrief

CVE-2026-23099 is a high-severity vulnerability in the Linux kernel's bonding module, specifically in the 8023AD mode. This vulnerability is caused by a lack of restriction on the network device type that can be used with BOND_MODE_8023AD, leading to a potential global out-of-bounds access. The vulnerability has a CVSS score of 7.1 and is considered high severity. The affected products include various versions of the Linux kernel. Defenders should prioritize patching this vulnerability to limit exposure to potential attacks.

Vendor
Linux kernel
Product
Linux kernel
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-04
Original CVE updated
2026-06-19
Advisory published
2026-02-04
Advisory updated
2026-06-19

Who should care

System administrators and security teams responsible for Linux kernel-based systems, especially those using bonding with 8023AD mode, should prioritize patching this vulnerability. This includes organizations with Linux-based servers, virtual machines, or network infrastructure. Additionally, Linux distribution maintainers and developers should apply patches to their supported versions.

Technical summary

The vulnerability is caused by the bonding module's 8023AD mode not being restricted to Ethernet devices only. This allows for a potential out-of-bounds access when a non-Ethernet device is used with BOND_MODE_8023AD. The bug was reported by syzbot and is caused by the lacpdu_mcast_addr variable being accessed with an incorrect address. The CVSS vector for this vulnerability is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H.

Defensive priority

High priority due to potential for elevation of privileges and high CVSS score

Recommended defensive actions

  • Apply official patches from the Linux kernel maintainers
  • Review and update Linux kernel versions to ensure they are running a patched version
  • Inventory Linux systems using bonding with 8023AD mode and prioritize patching
  • Monitor Linux kernel updates and apply patches in a timely manner
  • Consider implementing compensating controls, such as restricting network device types used with bonding

Evidence notes

The vulnerability was reported by syzbot and is caused by a lack of restriction on the network device type used with BOND_MODE_8023AD. The bug affects various Linux kernel versions, including versions 2.6.24 to 5.15.199, 5.16 to 6.1.162, 6.2 to 6.6.122, 6.7 to 6.12.68, and 6.13 to 6.18.8. The primary evidence for this vulnerability is the Linux kernel source code and the syzbot report.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-23099 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-23099

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-23099 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-23099

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/19266182b82e9100c799d8a29f5e0452f0bf7703

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/43dee6f7ef1d228821de1b61c292af3744c8d7da

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5063b2cd9b27d35ab788d707d7858ded0acc8f1d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/72925dbb0c8c7b16bf922e93c6cc03cbd8c955c4

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/80c881e53a4fa0a80fa4bef7bc0ead0e8e88940d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c84fcb79e5dbde0b8d5aeeaf04282d2149aebcf6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ef68afb1bee8d35a18896c27d7358079353d8d8a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.