PT-2026-43837 · Linux+1 · Linux Kernel+1
CVE-2026-45970
·
Published
2026-05-27
·
Updated
2026-07-21
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A use-after-free issue exists in the bonding ALB RX path. During rapid bond up/down cycles, the
rlb deinitialize() function frees the rx hashtbl while RX handlers are still active. This creates a race condition where the rlb arp recv() function can be accessed after recv probe is set to NULL, leading to a null pointer dereference when attempting to access a freed rx hashtbl entry.Recommendations
Set
recv probe to NULL and call synchronize net() to ensure all concurrent RX processing is complete before rx hashtbl is freed in bond alb deinitialize().Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Linux Kernel