CVE-2026-43441: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
In the Linux kernel, the following vulnerability has been resolved:
net: bonding: Fix ndtbl NULL dereference when IPv6 is disabled
When booting with the 'ipv6.disable=1' parameter, the ndtbl is never initialized because inet6init() exits before ndiscinit() is called which initializes it. If bonding ARP/NS validation is enabled, an IPv6 NS/NA packet received on a slave can reach bondvalidatena(), which calls bondhasthisip6(). That path calls ipv6chkaddr() and can crash in ipv6chkaddrandflags().
BUG: kernel NULL pointer dereference, address: 00000000000005d8 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:ipv6chkaddrandflags+0x69/0x170 Call Trace: <IRQ> ipv6chkaddr+0x1f/0x30 bondvalidatena+0x12e/0x1d0 [bonding] ? pfxbondhandleframe+0x10/0x10 [bonding] bondrcvvalidate+0x1a0/0x450 [bonding] bondhandleframe+0x5e/0x290 [bonding] ? srsoaliasreturnthunk+0x5/0xfbef5 netifreceiveskbcore.constprop.0+0x3e8/0xe50 ? srsoaliasreturnthunk+0x5/0xfbef5 ? updatecfsrqloadavg+0x1a/0x240 ? srsoaliasreturnthunk+0x5/0xfbef5 ? enqueueentity+0x5e/0x240 netifreceiveskbonecore+0x39/0xa0 processbacklog+0x9c/0x150 napipoll+0x30/0x200 ? srsoaliasreturnthunk+0x5/0xfbef5 netrxaction+0x338/0x3b0 handlesoftirqs+0xc9/0x2a0 dosoftirq+0x42/0x60 </IRQ> <TASK> localbhenableip+0x62/0x70 devqueuexmit+0x2d3/0x1000 ? srsoaliasreturnthunk+0x5/0xfbef5 ? srsoaliasreturnthunk+0x5/0xfbef5 ? packetparseheaders+0x10a/0x1a0 packetsendmsg+0x10da/0x1700 ? kickpool+0x5f/0x140 ? srsoaliasreturnthunk+0x5/0xfbef5 ? queuework+0x12d/0x4f0 syssendto+0x1f3/0x220 x64syssendto+0x24/0x30 dosyscall64+0x101/0xf80 ? excpagefault+0x6e/0x170 ? srsoaliasreturnthunk+0x5/0xfbef5 entrySYSCALL64afterhwframe+0x77/0x7f </TASK>
Fix this by checking ipv6modenabled() before dispatching IPv6 packets to bondnarcv(). If IPv6 is disabled, return early from bondrcvvalidate() and avoid the path to ipv6chkaddr().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - Configuration
Boot the system with the kernel parameter 'ipv6.disable=1' only if it is required; ensure the bonding mitigation/fix is applied because disabling IPv6 can otherwise trigger a NULL dereference in the bonding IPv6 NA validation path.
Linux kernel (IPv6) ipv6.disable = 1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43441?
CVE-2026-43441 is considered a high severity vulnerability due to the potential for a NULL pointer dereference leading to system instability.
How do I fix CVE-2026-43441?
To fix CVE-2026-43441, you should upgrade to the latest patched version of the Linux kernel that addresses this vulnerability.
What systems are affected by CVE-2026-43441?
CVE-2026-43441 affects systems running the Linux kernel where IPv6 is disabled at boot time.
What kind of attack vectors are possible with CVE-2026-43441?
Attack vectors associated with CVE-2026-43441 may lead to denial of service conditions through system crashes when IPv6 is disabled.
Is there a workaround for CVE-2026-43441?
A possible workaround for CVE-2026-43441 includes avoiding the use of the 'ipv6.disable=1' boot parameter until the kernel is updated.