PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45970 Linux CVE debrief

A use-after-free (UAF) vulnerability exists in the Linux kernel's bonding driver, specifically within the Adaptive Load Balancing (ALB) receive path. The flaw occurs when `rlb_arp_recv()` can still be accessed after `recv_probe` is set to NULL during rapid bond interface up/down cycles, leading to concurrent access with `rlb_deinitialize()` which frees `rx_hashtbl`. This race condition results in a null pointer dereference detected by KASAN, with the crash manifesting in `rlb_arp_recv+0x505/0xab0`. The vulnerability is triggered when ARP messages are received while repeatedly executing `ip link set bond0 up/down`. The fix involves setting `recv_probe` to NULL followed by `synchronize_net()` to ensure all concurrent RX processing completes before `rx_hashtbl` is freed in `bond_alb_deinitialize()`.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

System administrators running Linux systems with network bonding in ALB mode (balance-alb, mode 6), particularly those with dynamic network configurations or automated network management that may trigger rapid interface state changes. Cloud providers and hosting environments using bonded interfaces for redundancy should prioritize this patch.

Technical summary

The vulnerability is a use-after-free in the Linux kernel's bonding driver ALB (Adaptive Load Balancing) implementation. The RX path (`rlb_arp_recv`) can race with bond teardown (`rlb_deinitialize`) during rapid interface up/down operations. When `recv_probe` is set to NULL, concurrent RX handlers may still access `rx_hashtbl`, which gets freed by `rlb_deinitialize()`, resulting in UAF. The fix ensures proper synchronization using `synchronize_net()` before freeing the hash table.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable kernel git repositories when available for your distribution
  • Monitor for distribution-specific security advisories for kernel updates
  • If running systems with bonding ALB mode, plan maintenance windows for kernel updates
  • Review systems using `mode=6` (balance-alb) in bonding configuration as potentially affected
  • Consider network interface stability measures to reduce rapid up/down cycling until patched

Evidence notes

The CVE description provides detailed KASAN crash output showing the null-pointer dereference in `rlb_arp_recv` at offset 0x505, with RDI register containing 0x00000000000000e8 indicating the invalid memory access. The call trace confirms the issue occurs in the IRQ context during network receive processing. Multiple stable kernel commits are referenced indicating backports to various kernel versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45970 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45970

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45970 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45970

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c65cdf46ce340c9c00fbbaf84599d2daff43626e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d31065526f160ee0244a719230aa069daca2bf4d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/db5435b5342e3aaa4521d0f3ccfe94316b253ca1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/de7c097800f07f3c108185c7a38b53a530ba30ff

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e6834a4c474697df23ab9948fd3577b26bf48656

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f94a0de7b9f32745a14a1621c63087a092823587

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fd54ddc929be1d6c3b3b7b35d6d4642a5d9e803c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.