CVE-2026-98074 Linux CVE debrief

Who should care

Linux kernel developers and administrators who use the bonding module, as well as security teams and vulnerability management teams responsible for ensuring the security and integrity of Linux kernel-based systems. They should review the patch and verify its application to prevent potential security risks. Additionally, operators and platform administrators may need to be aware of the vulnerability and its potential impact on their systems.

Why it matters

A vulnerability in the Linux kernel's bonding module can lead to a permanent leak of promiscuous mode on the physical device, potentially increasing the risk of security breaches.

• Potential permanent leak of promiscuous mode on the physical device
• Increased risk of security breaches due to the leak of promiscuous mode

Technical summary

The vulnerability is caused by the premature clearing of curr_active_slave to NULL when releasing all slaves during bond destruction. This can lead to a permanent leak of promiscuous mode on the physical device. The issue arises because bond_change_active_slave is skipped when oldcurrent is NULL, causing bond_alb_handle_active_change to not decrement the promiscuity counter. As a result, the physical device may remain in promiscuous mode, increasing the risk of security breaches. The vulnerability can be resolved by replacing the if (all) branch with if (!all && oldcurrent == slave).

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to the Linux kernel's bonding module
• Verify that the Linux kernel is up-to-date with the latest security patches
• Monitor the Linux kernel for any potential issues related to the bonding module
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability was introduced in the Linux kernel's bonding module. The issue arises when releasing all slaves during bond destruction, causing the curr_active_slave to be prematurely cleared to NULL. This can lead to a permanent leak of promiscuous mode on the physical device. The source code indicates that the problem occurs when bond_alb_deinit_slave triggers rlb_teach_disabled_mac_on_primary, which increments the active slave dev promiscuity counter. However, bond_change_active_slave is skipped when oldcurrent is NULL, and bond

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.