CVE-2026-23119: bonding: provide a net pointer to __skb_flow_dissect()
In the Linux kernel, the following vulnerability has been resolved:
bonding: provide a net pointer to skbflowdissect()
After 3cbf4ffba5ee ("net: plumb network namespace into skbflowdissect") we have to provide a net pointer to skbflowdissect(), either via skb->dev, skb->sk, or a user provided pointer.
In the following case, syzbot was able to cook a bare skb.
WARNING: net/core/flowdissector.c:1131 at skbflowdissect+0xb57/0x68b0 net/core/flowdissector.c:1131, CPU#1: syz.2.1418/11053 Call Trace: <TASK> bondflowdissect drivers/net/bonding/bondmain.c:4093 [inline] bondxmithash+0x2d7/0xba0 drivers/net/bonding/bondmain.c:4157 bondxmithashxdp drivers/net/bonding/bondmain.c:4208 [inline] bondxdpxmit3adxorslaveget drivers/net/bonding/bondmain.c:5139 [inline] bondxdpgetxmitslave+0x1fd/0x710 drivers/net/bonding/bondmain.c:5515 xdpmasterredirect+0x13f/0x2c0 net/core/filter.c:4388 bpfprogrunxdp include/net/xdp.h:700 [inline] bpftestrun+0x6b2/0x7d0 net/bpf/testrun.c:421 bpfprogtestrunxdp+0x795/0x10e0 net/bpf/testrun.c:1390 bpfprogtestrun+0x2c7/0x340 kernel/bpf/syscall.c:4703 sysbpf+0x562/0x860 kernel/bpf/syscall.c:6182 dosysbpf kernel/bpf/syscall.c:6274 [inline] sesysbpf kernel/bpf/syscall.c:6272 [inline] x64sysbpf+0x7c/0x90 kernel/bpf/syscall.c:6272 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xec/0xf80 arch/x86/entry/syscall64.c:94
Affected Software
Remediation
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
The CVSS vector indicates local access with low privileges is required. No user interaction is required.
Which systems are most relevant for triage?
The reported failure path involves Linux kernel bonding together with XDP and BPF test-run handling. The trace reaches bond_xdp_get_xmit_slave through xdp_master_redirect and bpf_prog_test_run_xdp.
What can be done if the affected kernel cannot be patched immediately?
The provided data identifies a patch as available but does not document a workaround. Prioritize restricting untrusted local users from exercising BPF/XDP test-run functionality and bonding/XDP paths where operationally feasible.
How might this issue appear on an affected system?
The reported symptom is a WARNING in net/core/flow_dissector.c at line 1131 in __skb_flow_dissect. Relevant call-trace functions include bond_flow_dissect, __bond_xmit_hash, bond_xdp_get_xmit_slave, xdp_master_redirect, and bpf_prog_test_run_xdp.