PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23310 Linux CVE debrief

A logic gap in the Linux kernel's bonding driver allows an incompatible transmit hash policy change while XDP is loaded, leading to a WARN_ON splat during bond teardown. The vulnerability exists because bond_option_xmit_hash_policy_set() lacked the bond_xdp_check() guard present in bond_option_mode_set(). When a user changes xmit_hash_policy to vlan+srcmac after XDP attachment on a bond in 802.3ad or balance-xor mode, subsequent bond destruction triggers dev_xdp_uninstall() → bond_xdp_set() → bond_xdp_check() failure, causing a warning splat. The fix adds the missing guard to reject vlan+srcmac policy changes when XDP is active on affected bond modes.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-25
Original CVE updated
2026-05-28
Advisory published
2026-03-25
Advisory updated
2026-05-28

Who should care

Linux system administrators running bonded network interfaces with XDP programs; security teams monitoring kernel stability; network engineers using 802.3ad or balance-xor bonding modes

Technical summary

The Linux kernel bonding driver's bond_option_xmit_hash_policy_set() function failed to validate XDP program compatibility when changing the transmit hash policy to vlan+srcmac. This allowed a configuration state where bond->xdp_prog remained set but bond_xdp_check() would return false, causing dev_xdp_uninstall() to fail with -EOPNOTSUPP and trigger WARN_ON during bond destruction. The vulnerability affects 802.3ad and balance-xor bonding modes. The fix adds bond_xdp_check() validation to prevent incompatible policy changes while XDP is loaded.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches (5.15.130+, 6.6.130+, 6.12.77+, 6.18.17+, 6.19.7+) to add the missing bond_xdp_check() guard in bond_option_xmit_hash_policy_set()
  • Monitor kernel logs for WARN_ON messages related to dev_xdp_install on bond interfaces, which may indicate exploitation attempts or existing incompatible configurations
  • Review bond configurations to ensure xmit_hash_policy is not set to vlan+srcmac when XDP programs are loaded on 802.3ad or balance-xor bonds
  • Upgrade to kernel 6.19.7 or later, or 7.0-rc3 or later, which contain the fix

Evidence notes

The vulnerability description and patch references confirm the issue affects Linux kernel bonding driver versions 5.15 through 6.19.7, plus 7.0-rc1 and 7.0-rc2. The fix was committed to multiple stable branches as referenced in the NVD record.

Official resources

2026-03-25