--- id: CVE-2026-31419 title: |- In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clo… summary: |- In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clo… severity: high cvss: 7.8 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-416 vendor: linux product: linux_kernel affected: - 'linux_kernel >= 5.10.94, < 5.11' - 'linux_kernel >= 5.15.17, < 5.16' - 'linux_kernel >= 5.16.3, < 5.17' - 'linux_kernel >= 5.17, < 6.12.86' - 'linux_kernel >= 6.13, < 6.18.22' - 'linux_kernel >= 6.19, < 6.19.12' - linux_kernel = 7.0 patched: - linux_kernel 6.19.12 published: '2026-04-13' updated: '2026-07-04' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-31419' references: - url: 'https://git.kernel.org/stable/c/2884bf72fb8f03409e423397319205de48adca16' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/2de5c8eea0a9db99dae7c36f4b541b74b41d3a04' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/a0f661918edc79d7a75e468128af8d41e2a1a83a' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/d4cc7e4c80b1634c7b1497574a2fdb18df6c026c' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/f5b94654a4a19891a8108d66ef166de6c028c6cd' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://access.redhat.com/errata/RHSA-2026:13566' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:19521' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:21209' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:22334' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:22900' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:22940' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23224' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:25191' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:25217' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27353' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27354' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-31419' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2457829' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31419.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://git.kernel.org/stable/c/00752893f96b344f258c9c6de18b33171ac4872c' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-31419' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-31419' - url: >- https://lore.kernel.org/linux-cve-announce/2026041353-CVE-2026-31419-e176@gregkh/T - url: 'https://access.redhat.com/errata/RHSA-2026:35870' - url: 'https://access.redhat.com/errata/RHSA-2026:36530' - url: 'https://access.redhat.com/errata/RHSA-2026:36531' - url: 'https://access.redhat.com/errata/RHSA-2026:36532' - url: 'https://access.redhat.com/errata/RHSA-2026:36533' - url: 'https://access.redhat.com/errata/RHSA-2026:36534' - url: 'https://access.redhat.com/errata/RHSA-2026:36172' tags: - nvd - cve.org - csaf - vex - red-hat epss: 0.00129 epssPercentile: 0.02509 ingestedAt: '2026-07-04T12:56:09.352Z' ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-10-16T15:09:08.906422Z' scores: nvd: 7.8 vendor: 7 cna: 7.8 --- ## Overview In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concurrent slave enslave/release can mutate the slave list during RCU-protected iteration, changing which slave is "last" mid-loop. This causes the original skb to be double-consumed (double-freed). Replace the racy bond_is_last_slave() check with a simple index comparison (i + 1 == slaves_count) against the pre-snapshot slave count taken via READ_ONCE() before the loop. This preserves the zero-copy optimization for the last slave while making the "last" determination stable against concurrent list mutations. The UAF can trigger the following crash: ================================================================== BUG: KASAN: slab-use-after-free in skb_clone Read of size 8 at addr ffff888100ef8d40 by task exploit/147 CPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY Call Trace: dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:597) skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334) bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593) dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887) __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838) ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136) ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219) ip6_output (net/ipv6/ip6_output.c:250) ip6_send_skb (net/ipv6/ip6_output.c:1985) udp_v6_send_skb (net/ipv6/udp.c:1442) udpv6_sendmsg (net/ipv6/udp.c:1733) __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Allocated by task 147: Freed by task 147: The buggy address belongs to the object at ffff888100ef8c80 which belongs to the cache skbuff_head_cache of size 224 The buggy address is located 192 bytes inside of freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60) Memory state around the buggy address: ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ## Affected - `linux_kernel >= 5.10.94, < 5.11` - `linux_kernel >= 5.15.17, < 5.16` - `linux_kernel >= 5.16.3, < 5.17` - `linux_kernel >= 5.17, < 6.12.86` - `linux_kernel >= 6.13, < 6.18.22` - `linux_kernel >= 6.19, < 6.19.12` - `linux_kernel = 7.0` ## Remediation Upgrade past the affected range: - `linux_kernel 6.19.12` ## Vendor advisories - **RHSA-2026:22334** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0) · released 2026-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:22334) - **RHSA-2026:13566** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13566) - **RHSA-2026:25191** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-06-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:25191) - **RHSA-2026:22940** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2) · released 2026-06-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:22940) - **RHSA-2026:21209** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4), Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4), Red Hat Enterprise Linux Real Time EUS (v.9.4) · released 2026-05-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:21209) - **RHSA-2026:23224** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6) · released 2026-06-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:23224) - **RHSA-2026:25217** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-06-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:25217) - **RHSA-2026:35870** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35870) - **RHSA-2026:27353** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-06-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:27353) - **RHSA-2026:36530** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8) · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36530) - **RHSA-2026:19521** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8) · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:19521) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31419.json)