PT-2026-39117 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-15 · CVE-2026-43456

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A type confusion exists in the bonding driver within the bond setup by slave() function. When a non-Ethernet device, such as a GRE tunnel, is enslaved to a bond, the driver directly copies the slave's header operations to the bond device. Consequently, when dev hard header() is called on the bond device, functions like ipgre header() or ip6gre header() use netdev priv() to access device-specific private data. This results in the function receiving the bond's private data (struct bonding) instead of the expected slave data (e.g., struct ip tunnel), leading to the processing of invalid values and subsequent kernel crashes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43456

Affected Products

Linux Kernel

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-43456 · Security Note
• https://git.kernel.org/stable/c/9baf26a91565b7bb2b1d9f99aaf884a2b28c2f6d · Note
• https://twitter.com/CVEnew/status/2052767608932569117 · Twitter Post
• https://git.kernel.org/stable/c/95597d11dc8bddb2b9a051c9232000bfbb5e43ba · Note
• https://twitter.com/windowsforum/status/2053780423134642362 · Twitter Post
• https://git.kernel.org/stable/c/950803f7254721c1c15858fbbfae3deaaeeecb11 · Note
• https://twitter.com/hetmehtaa/status/2055151398283837677 · Twitter Post
• https://git.kernel.org/stable/c/6ac890f1d60ac3707ee8dae15a67d9a833e49956 · Note