PT-2026-27675 · Linux · Linux
Published
2026-03-25
·
Updated
2026-03-25
·
CVE-2026-23310
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
bpf/bonding: reject vlan+srcmac xmit hash policy change when XDP is loaded
bond option mode set() already rejects mode changes that would make a
loaded XDP program incompatible via bond xdp check(). However,
bond option xmit hash policy set() has no such guard.
For 802.3ad and balance-xor modes, bond xdp check() returns false when
xmit hash policy is vlan+srcmac, because the 802.1q payload is usually
absent due to hardware offload. This means a user can:
- Attach a native XDP program to a bond in 802.3ad/balance-xor mode with a compatible xmit hash policy (e.g. layer2+3).
- Change xmit hash policy to vlan+srcmac while XDP remains loaded.
This leaves bond->xdp prog set but bond xdp check() now returning false
for the same device. When the bond is later destroyed, dev xdp uninstall()
calls bond xdp set(dev, NULL, NULL) to remove the program, which hits
the bond xdp check() guard and returns -EOPNOTSUPP, triggering:
WARN ON(dev xdp install(dev, mode, bpf op, NULL, 0, NULL))
Fix this by rejecting xmit hash policy changes to vlan+srcmac when an
XDP program is loaded on a bond in 802.3ad or balance-xor mode.
commit 39a0876d595b ("net, bonding: Disallow vlan+srcmac with XDP")
introduced bond xdp check() which returns false for 802.3ad/balance-xor
modes when xmit hash policy is vlan+srcmac. The check was wired into
bond xdp set() to reject XDP attachment with an incompatible policy, but
the symmetric path -- preventing xmit hash policy from being changed to an
incompatible value after XDP is already loaded -- was left unguarded in
bond option xmit hash policy set().
Note:
commit 094ee6017ea0 ("bonding: check xdp prog when set bond mode")
later added a similar guard to bond option mode set(), but
bond option xmit hash policy set() remained unprotected.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux