CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave()
In the Linux kernel, the following vulnerability has been resolved:
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1165.176~18.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1170.176~18.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1168.178~18.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-242.262~18.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1111.116~18.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1163.173~18.04.1 - Upgrade
Upgrade
ubuntu/linux-raspi-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1148.161~18.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.4.0-242.262 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.4.0-1165.176 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.4.0-1170.176 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.4.0-1168.178 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.4.0-1111.116 - Upgrade
Upgrade
ubuntu/linux-iotto a version that resolves this vulnerability.Fixed in 5.4.0-1069.72 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.4.0-1152.161 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.4.0-1163.173 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 5.4.0-1148.161 - Upgrade
Upgrade
ubuntu/linux-xilinx-zynqmpto a version that resolves this vulnerability.Fixed in 5.4.0-1083.87 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1165.176+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1170.176+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1139.149 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1168.178+fips1 - Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1061.64~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1063.71~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1062.69~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1064.72~22.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-136.136~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1061.62~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-136.136.2~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1059.62~22.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1058.61~22.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-136.136~22.04.3 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1056.57~22.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-136.136 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1061.64 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1063.71 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1062.69 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1064.72 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1059.67 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1046.50 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1061.62 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-136.136.2 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1059.62 - Upgrade
Upgrade
ubuntu/linux-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1059.62.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1030.31 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1058.61 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1061.65 - Upgrade
Upgrade
ubuntu/linux-xilinxto a version that resolves this vulnerability.Fixed in 6.8.0-1033.34 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1028.33 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2050.52 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1056.57 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1061.64+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1063.71+fips2 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-136.136+fips2 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1064.72+fips1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.85-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.10-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.14-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.145 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.78 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.19 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.19.9 - Compensating control
In the bonding driver, introduce bond_header_ops wrapper functions that delegate to the active slave's header_ops using the slave's own device, instead of having bond_setup_by_slave() directly copy slave_dev->header_ops to bond_dev->header_ops.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43456?
CVE-2026-43456 is classified as a high severity vulnerability in the Linux kernel.
How do I fix CVE-2026-43456?
To fix CVE-2026-43456, update the Linux kernel to the latest patched version provided by your distribution.
What type of vulnerability is CVE-2026-43456?
CVE-2026-43456 is a type confusion vulnerability that occurs in the bond_setup_by_slave function in the Linux kernel.
In which versions of the Linux kernel does CVE-2026-43456 exist?
CVE-2026-43456 affects certain versions of the Linux kernel, primarily those prior to the latest security updates.
What impact does CVE-2026-43456 have on system security?
CVE-2026-43456 can potentially lead to denial of service or other security impacts due to its nature as a type confusion vulnerability.