CVE-2026-98089: bonding: alb: fix uninitialized transport header access in alb_determine_nd()
In the Linux kernel, the following vulnerability has been resolved:
bonding: alb: fix uninitialized transport header access in albdeterminend()
albdeterminend() uses icmp6hdr(skb) to inspect ICMPv6 headers. However, in xmit paths (e.g. packets sent via AFPACKET / raw sockets or forwarded packets), skb->transportheader is not guaranteed to be initialized. While pskbnetworkmaypull() ensures the packet data is linear starting from the network header, it does not set or adjust the transport header offset.
Dereferencing icmp6hdr(skb) can therefore access out-of-bounds memory.
Fetch the icmp6hdr directly after ipv6hdr following pskbnetworkmaypull(), and reload ipv6hdr in case pskbmaypull() reallocated skb->head. Also remove the unused bond argument from albdeterminend().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update bonding:alb alb_determine_nd() to fetch the ICMPv6 header directly after the IPv6 header following pskb_network_may_pull(), reload ipv6hdr if pskb_may_pull() reallocates skb->head, and remove the unused bond argument.
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems using the Linux kernel bonding driver with adaptive load balancing (ALB) functionality are relevant. The unsafe access occurs on transmit-related paths involving IPv6 packets, including packets sent through AF_PACKET or raw sockets and forwarded packets.
What packet conditions are needed to trigger the vulnerable access?
The affected code must inspect an IPv6 packet as ICMPv6 in alb_determine_nd(), while the socket buffer's transport_header offset is not initialized. This can occur even when packet data is linear from the network header, because pskb_network_may_pull() does not initialize or correct the transport header offset.
How can administrators determine whether their kernel contains the fix?
Check whether the installed kernel includes one of the referenced stable commits: e39cf90bd856443542b97933289749fca07476bf, 27314f96d29b54e815e7a9b84c3273f1895e68e2, or 3b178894931a268c09126a5b53630f343e10e296. The corrected code obtains the ICMPv6 header directly after the IPv6 header rather than using icmp6_hdr(skb) with an uninitialized transport-header offset.