CVE-2026-23171: bonding: fix use-after-free due to enslave fail after slave array update
bonding: fix use-after-free due to enslave fail after slave array update
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (bonding)to a version that resolves this vulnerability.Fixed in 6.19.0-rc6+ #21 - Configuration
Apply the bonding fix so that the new slave can be used for Tx only after XDP setup; this prevents the use-after-free caused by enslave failure and the cleanup path freeing allocated slave memory.
bonding Tx slave array update / enslave failure ordering = Move the new slave usage for Tx to after XDP setup to avoid use-after-free after enslave failure
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23171?
CVE-2026-23171 has been rated as a medium severity vulnerability.
How do I fix CVE-2026-23171?
To fix CVE-2026-23171, upgrade to the patched version of the Linux kernel that addresses this vulnerability.
What is the impact of CVE-2026-23171 on system security?
The impact of CVE-2026-23171 can lead to potential system instability or exploitation through a use-after-free condition.
Which Linux kernel versions are affected by CVE-2026-23171?
CVE-2026-23171 affects specific versions of the Linux kernel, particularly those prior to the security patch release.
What components are impacted by CVE-2026-23171?
CVE-2026-23171 impacts the bonding subsystem in the Linux kernel due to issues with slave array management.