PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23310 Linux CVE debrief

A logic gap in the Linux kernel's bonding driver allows an incompatible transmit hash policy change while XDP is loaded, leading to a WARN_ON splat during bond teardown. The vulnerability exists because bond_option_xmit_hash_policy_set() lacked the bond_xdp_check() guard present in bond_option_mode_set(). When a user changes xmit_hash_policy to vlan+srcmac after XDP attachment on a bond in 802.3ad or balance-xor mode, subsequent bond destruction triggers dev_xdp_uninstall() → bond_xdp_set() → bond_xdp_check() failure, causing a warning splat. The fix adds the missing guard to reject vlan+srcmac policy changes when XDP is active on affected bond modes.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-25
Original CVE updated
2026-06-19
Advisory published
2026-03-25
Advisory updated
2026-06-19

Who should care

Linux system administrators running bonded network interfaces with XDP programs; security teams monitoring kernel stability; network engineers using 802.3ad or balance-xor bonding modes

Technical summary

The Linux kernel bonding driver's bond_option_xmit_hash_policy_set() function failed to validate XDP program compatibility when changing the transmit hash policy to vlan+srcmac. This allowed a configuration state where bond->xdp_prog remained set but bond_xdp_check() would return false, causing dev_xdp_uninstall() to fail with -EOPNOTSUPP and trigger WARN_ON during bond destruction. The vulnerability affects 802.3ad and balance-xor bonding modes. The fix adds bond_xdp_check() validation to prevent incompatible policy changes while XDP is loaded.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches (5.15.130+, 6.6.130+, 6.12.77+, 6.18.17+, 6.19.7+) to add the missing bond_xdp_check() guard in bond_option_xmit_hash_policy_set()
  • Monitor kernel logs for WARN_ON messages related to dev_xdp_install on bond interfaces, which may indicate exploitation attempts or existing incompatible configurations
  • Review bond configurations to ensure xmit_hash_policy is not set to vlan+srcmac when XDP programs are loaded on 802.3ad or balance-xor bonds
  • Upgrade to kernel 6.19.7 or later, or 7.0-rc3 or later, which contain the fix

Evidence notes

The vulnerability description and patch references confirm the issue affects Linux kernel bonding driver versions 5.15 through 6.19.7, plus 7.0-rc1 and 7.0-rc2. The fix was committed to multiple stable branches as referenced in the NVD record.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-23310 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-23310

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-23310 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-23310

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0ace8027e41f6f094ef6c1aca42d2ed6cd7af54e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/479d589b40b836442bbdadc3fdb37f001bb67f26

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5c262bd0e39320a6d6c8277cb8349ce21c01b8c1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d36ad7e126c6a0c5f699583309ccc37e3a3263ea

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e85fa809e507b9d8eff4840888b8c727e4e8448c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.