PT-2026-20424 · Linux+2 · Linux Kernel+2
Syzbot
·
Published
2026-01-01
·
Updated
2026-06-04
·
CVE-2026-23212
CVSS v3.1
4.7
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel contains a data race condition related to the handling of bonded network interfaces. Specifically, the
slave->last rx and slave->target last arp rx variables can be read and written without proper locking mechanisms. This can occur during interrupt handling within the bond rcv validate and bond handle frame functions. The issue was identified through reports from syzbot, a kernel testing tool, which detected a Kernel Concurrent State SANitizer (KCSAN) data race. The data race occurs when multiple CPUs attempt to access and modify these variables concurrently, potentially leading to unpredictable behavior or system instability. The functions involved are bond rcv validate, bond handle frame, netif receive skb core, netif receive skb one core, netif receive skb, netif receive skb internal, netif receive skb, and br netif receive skb.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Time Of Check To Time Of Use
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Ubuntu