{"id":"CVE-2026-31419","summary":"net: bonding: fix use-after-free in bond_xmit_broadcast()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix use-after-free in bond_xmit_broadcast()\n\nbond_xmit_broadcast() reuses the original skb for the last slave\n(determined by bond_is_last_slave()) and clones it for others.\nConcurrent slave enslave/release can mutate the slave list during\nRCU-protected iteration, changing which slave is \"last\" mid-loop.\nThis causes the original skb to be double-consumed (double-freed).\n\nReplace the racy bond_is_last_slave() check with a simple index\ncomparison (i + 1 == slaves_count) against the pre-snapshot slave\ncount taken via READ_ONCE() before the loop.  This preserves the\nzero-copy optimization for the last slave while making the \"last\"\ndetermination stable against concurrent list mutations.\n\nThe UAF can trigger the following crash:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in skb_clone\nRead of size 8 at addr ffff888100ef8d40 by task exploit/147\n\nCPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl (lib/dump_stack.c:123)\n print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n kasan_report (mm/kasan/report.c:597)\n skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108)\n bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334)\n bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593)\n dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887)\n __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838)\n ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136)\n ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219)\n ip6_output (net/ipv6/ip6_output.c:250)\n ip6_send_skb (net/ipv6/ip6_output.c:1985)\n udp_v6_send_skb (net/ipv6/udp.c:1442)\n udpv6_sendmsg (net/ipv6/udp.c:1733)\n __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206)\n __x64_sys_sendto (net/socket.c:2209)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n \u003c/TASK\u003e\n\nAllocated by task 147:\n\nFreed by task 147:\n\nThe buggy address belongs to the object at ffff888100ef8c80\n which belongs to the cache skbuff_head_cache of size 224\nThe buggy address is located 192 bytes inside of\n freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60)\n\nMemory state around the buggy address:\n ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc\n ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003effff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\n                                                    ^\n ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb\n ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n==================================================================","modified":"2026-11-01T02:30:31.776495703Z","published":"2026-04-13T13:40:23.279Z","related":["ALSA-2026:13566","ALSA-2026:25191","ALSA-2026:25217","ALSA-2026:27353","ALSA-2026:27354"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31419.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/00752893f96b344f258c9c6de18b33171ac4872c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/060d83bb6147c36fc21134d5b332d266b8c176bc"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2884bf72fb8f03409e423397319205de48adca16"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2de5c8eea0a9db99dae7c36f4b541b74b41d3a04"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a0f661918edc79d7a75e468128af8d41e2a1a83a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d4cc7e4c80b1634c7b1497574a2fdb18df6c026c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/df690112b2172e8eb0f4dd8ec1019b65ee979203"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f5b94654a4a19891a8108d66ef166de6c028c6cd"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31419.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13566"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19521"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21209"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22334"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22900"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22940"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23224"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25191"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25217"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27353"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27354"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:35870"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36172"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36530"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36531"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36532"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36533"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36534"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-31419"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31419.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31419"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457829"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"20949c3816463e97c6f8fe84c0280c7e5ae83a8d"},{"fixed":"060d83bb6147c36fc21134d5b332d266b8c176bc"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"f1d206181f19b00b275b258fea1418718a2f4173"},{"fixed":"df690112b2172e8eb0f4dd8ec1019b65ee979203"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4e5bd03ae34652cd932ab4c91c71c511793df75c"},{"fixed":"00752893f96b344f258c9c6de18b33171ac4872c"},{"fixed":"2de5c8eea0a9db99dae7c36f4b541b74b41d3a04"},{"fixed":"a0f661918edc79d7a75e468128af8d41e2a1a83a"},{"fixed":"d4cc7e4c80b1634c7b1497574a2fdb18df6c026c"},{"fixed":"f5b94654a4a19891a8108d66ef166de6c028c6cd"},{"fixed":"2884bf72fb8f03409e423397319205de48adca16"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.10.94"},{"fixed":"5.10.273"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.15.17"},{"fixed":"5.15.224"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.16.3"},{"fixed":"5.17"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"c1f1691ef84fa6d38fa5e5148eca073145e97ffa"}]}],"versions":["v5.10.272","v5.10.271","v5.10.270","v5.10.269","v5.10.268","v5.10.267","v5.10.266","v5.10.265","v5.10.264","v5.10.263","v5.10.262","v5.10.261","v5.10.260","v5.10.259","v5.10.258","v5.10.257","v5.10.256","v5.10.255","v5.10.254","v5.10.253","v5.10.252","v5.10.251","v5.10.250","v5.10.249","v5.10.248","v5.10.247","v5.10.246","v5.10.245","v5.10.244","v5.10.243","v5.10.242","v5.10.241","v5.10.240","v5.10.239","v5.10.238","v5.10.237","v5.10.236","v5.10.235","v5.10.234","v5.10.233","v5.10.232","v5.10.231","v5.10.230","v5.10.229","v5.10.228","v5.10.227","v5.10.226","v5.10.225","v5.10.224","v5.10.223","v5.10.222","v5.10.221","v5.10.220","v5.10.219","v5.10.218","v5.10.217","v5.10.216","v5.10.215","v5.10.214","v5.10.213","v5.10.212","v5.10.211","v5.10.210","v5.10.209","v5.10.208","v5.10.207","v5.10.206","v5.10.205","v5.10.204","v5.10.203","v5.10.202","v5.10.201","v5.10.200","v5.10.199","v5.10.198","v5.10.197","v5.10.196","v5.10.195","v5.10.194","v5.10.193","v5.10.192","v5.10.191","v5.10.190","v5.10.189","v5.10.188","v5.10.187","v5.10.186","v5.10.185","v5.10.184","v5.10.183","v5.10.182","v5.10.181","v5.10.180","v5.10.179","v5.10.178","v5.10.177","v5.10.176","v5.10.175","v5.10.174","v5.10.173","v5.10.172","v5.10.171","v5.10.170","v5.10.169","v5.10.168","v5.10.167","v5.10.166","v5.10.165","v5.10.164","v5.10.163","v5.10.162","v5.10.161","v5.10.160","v5.10.159","v5.10.158","v5.10.157","v5.10.156","v5.10.155","v5.10.154","v5.10.153","v5.10.152","v5.10.151","v5.10.150","v5.10.149","v5.10.148","v5.10.147","v5.10.146","v5.10.145","v5.10.144","v5.10.143","v5.10.142","v5.10.141","v5.10.140","v5.10.139","v5.10.138","v5.10.137","v5.10.136","v5.10.135","v5.10.134","v5.10.133","v5.10.132","v5.10.131","v5.10.130","v5.10.129","v5.10.128","v5.10.127","v5.10.126","v5.10.125","v5.10.124","v5.10.123","v5.10.122","v5.10.121","v5.10.120","v5.10.119","v5.10.118","v5.10.117","v5.10.116","v5.10.115","v5.10.114","v5.10.113","v5.10.112","v5.10.111","v5.10.110","v5.10.109","v5.10.108","v5.10.107","v5.10.106","v5.10.105","v5.10.104","v5.10.103","v5.10.102","v5.10.101","v5.10.100","v5.10.99","v5.10.98","v5.10.97","v5.10.96","v5.10.95","v5.10.94","v5.15.223","v5.15.222","v5.15.221","v5.15.220","v5.15.219","v5.15.218","v5.15.217","v5.15.216","v5.15.215","v5.15.214","v5.15.213","v5.15.212","v5.15.211","v5.15.210","v5.15.209","v5.15.208","v5.15.207","v5.15.206","v5.15.205","v5.15.204","v5.15.203","v5.15.202","v5.15.201","v5.15.200","v5.15.199","v5.15.198","v5.15.197","v5.15.196","v5.15.195","v5.15.194","v5.15.193","v5.15.192","v5.15.191","v5.15.190","v5.15.189","v5.15.188","v5.15.187","v5.15.186","v5.15.185","v5.15.184","v5.15.183","v5.15.182","v5.15.181","v5.15.180","v5.15.179","v5.15.178","v5.15.177","v5.15.176","v5.15.175","v5.15.174","v5.15.173","v5.15.172","v5.15.171","v5.15.170","v5.15.169","v5.15.168","v5.15.167","v5.15.166","v5.15.165","v5.15.164","v5.15.163","v5.15.162","v5.15.161","v5.15.160","v5.15.159","v5.15.158","v5.15.157","v5.15.156","v5.15.155","v5.15.154","v5.15.153","v5.15.152","v5.15.151","v5.15.150","v5.15.149","v5.15.148","v5.15.147","v5.15.146","v5.15.145","v5.15.144","v5.15.143","v5.15.142","v5.15.141","v5.15.140","v5.15.139","v5.15.138","v5.15.137","v5.15.136","v5.15.135","v5.15.134","v5.15.133","v5.15.132","v5.15.131","v5.15.130","v5.15.129","v5.15.128","v5.15.127","v5.15.126","v5.15.125","v5.15.124","v5.15.123","v5.15.122","v5.15.121","v5.15.120","v5.15.119","v5.15.118","v5.15.117","v5.15.116","v5.15.115","v5.15.114","v5.15.113","v5.15.112","v5.15.111","v5.15.110","v5.15.109","v5.15.108","v5.15.107","v5.15.106","v5.15.105","v5.15.104","v5.15.103","v5.15.102","v5.15.101","v5.15.100","v5.15.99","v5.15.98","v5.15.97","v5.15.96","v5.15.95","v5.15.94","v5.15.93","v5.15.92","v5.15.91","v5.15.90","v5.15.89","v5.15.88","v5.15.87","v5.15.86","v5.15.85","v5.15.84","v5.15.83","v5.15.82","v5.15.81","v5.15.80","v5.15.79","v5.15.78","v5.15.77","v5.15.76","v5.15.75","v5.15.74","v5.15.73","v5.15.72","v5.15.71","v5.15.70","v5.15.69","v5.15.68","v5.15.67","v5.15.66","v5.15.65","v5.15.64","v5.15.63","v5.15.62","v5.15.61","v5.15.60","v5.15.59","v5.15.58","v5.15.57","v5.15.56","v5.15.55","v5.15.54","v5.15.53","v5.15.52","v5.15.51","v5.15.50","v5.15.49","v5.15.48","v5.15.47","v5.15.46","v5.15.45","v5.15.44","v5.15.43","v5.15.42","v5.15.41","v5.15.40","v5.15.39","v5.15.38","v5.15.37","v5.15.36","v5.15.35","v5.15.34","v5.15.33","v5.15.32","v5.15.31","v5.15.30","v5.15.29","v5.15.28","v5.15.27","v5.15.26","v5.15.25","v5.15.24","v5.15.23","v5.15.22","v5.15.21","v5.15.20","v5.15.19","v5.15.18","v5.15.17","v5.16.20","v5.16.19","v5.16.18","v5.16.17","v5.16.16","v5.16.15","v5.16.14","v5.16.13","v5.16.12","v5.16.11","v5.16.10","v5.16.9","v5.16.8","v5.16.7","v5.16.6","v5.16.5","v5.16.4","v5.16.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31419.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.273"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.224"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.184"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.17.0"},{"fixed":"6.6.143"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.12.95"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.18.22"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.19.12"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31419.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}