CVE-2026-74726 Linux CVE debrief

Who should care

Linux kernel developers, administrators who use the bonding module, security teams, and vulnerability management teams should review and apply the provided patches to prevent potential issues. They should also monitor the Linux kernel for any potential issues related to the bonding module and implement compensating controls to mitigate the impact of the vulnerability.

Why it matters

A vulnerability in the Linux kernel's bonding module allows for a general protection fault due to improper handling of promiscuity settings. Linux kernel developers and administrators who use the bonding module should review and apply the provided patches to prevent potential issues.

• Potential general protection faults or underflow of the new slave's promiscuity counter
• Need to review and apply patches to the Linux kernel
• Potential impact on system stability and security

Technical summary

The vulnerability is caused by a race condition in the bond_alb_monitor function. The function reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing the promiscuity it set on the active slave. In that window, the active slave can change under RTNL, leading to potential faults or underflow of the new slave's promiscuity counter. This issue affects Linux kernel developers and administrators who use the bonding module. The vulnerability can lead to general protection faults or underflow of the new slave's promiscuity counter, potentially impacting system stability and security.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Ensure that the Linux kernel is up-to-date with the latest security patches
• Monitor the Linux kernel for any potential issues related to the bonding module
• Perform a thorough review of the system configuration and network setup to identify potential vulnerabilities
• Implement compensating controls to mitigate the impact of the vulnerability
• Conduct regular security audits and vulnerability assessments to identify potential weaknesses
• Track and analyze system logs to detect potential security incidents

Evidence notes

The vulnerability is caused by a race condition in the bond_alb_monitor function. The function reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing the promiscuity it set on the active slave. In that window, the active slave can change under RTNL, leading to potential faults or underflow of the new slave's promiscuity counter.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.