CVE-2026-23099: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-23099 Overview

CVE-2026-23099 is a memory safety vulnerability in the Linux kernel's bonding driver that allows a global out-of-bounds read when BOND_MODE_8023AD (IEEE 802.3ad Link Aggregation) is incorrectly applied to non-Ethernet devices. The vulnerability occurs in the __hw_addr_create function within net/core/dev_addr_lists.c when processing multicast addresses for bonded interfaces that are not of the ARPHRD_ETHER type.

Critical Impact

Local attackers can trigger a kernel crash or potentially leak sensitive kernel memory through a global out-of-bounds read in the bonding driver.

Affected Products

• Linux kernel (multiple stable versions)
• Systems using network bonding with 802.3ad mode
• Virtual and physical network configurations with bonded interfaces

Discovery Timeline

• 2026-02-04 - CVE CVE-2026-23099 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-23099

Vulnerability Analysis

This vulnerability stems from insufficient device type validation in the Linux kernel's bonding driver when configuring interfaces in BOND_MODE_8023AD mode. The IEEE 802.3ad standard defines Link Aggregation Control Protocol (LACP) specifically for Ethernet devices (ARPHRD_ETHER). When the kernel attempts to add the LACP multicast address (lacpdu_mcast_addr) to a non-Ethernet interface being enslaved to a bonding group, the code reads beyond the bounds of the global multicast address variable.

The out-of-bounds read occurs in the __hw_addr_create function when __asan_memcpy attempts to copy 16 bytes from lacpdu_mcast_addr, which is a fixed-size buffer that doesn't accommodate the requested copy operation for non-Ethernet hardware address lengths. This results in a KASAN (Kernel Address Sanitizer) violation indicating access to memory at 0xffffffff8bf94040 beyond the legitimate variable boundaries.

Root Cause

The root cause is a missing device type check in the bond_enslave function within drivers/net/bonding/bond_main.c. Before adding a slave interface to a bonding group configured with BOND_MODE_8023AD, the code should verify that the interface is an Ethernet device (ARPHRD_ETHER). Without this validation, the kernel proceeds to call dev_mc_add with the LACP multicast address, which triggers the out-of-bounds memory access when the underlying device has a different hardware address format.

The call path leading to the vulnerability follows: bond_enslave → dev_mc_add → __dev_mc_add → __hw_addr_add_ex → __hw_addr_create, where the memory copy operation assumes Ethernet-compatible address lengths.

Attack Vector

The vulnerability can be triggered by a local attacker with sufficient privileges to configure network interfaces. Using netlink messages through rtnetlink_rcv_msg, an attacker can create a bonding interface in 802.3ad mode and then attempt to enslave a non-Ethernet interface to it. The exploitation path involves:

The attack proceeds through the rtnl_newlink → do_setlink → do_set_master → bond_enslave chain, ultimately reaching the vulnerable memory copy operation. While this requires local access and CAP_NET_ADMIN capability, it can cause system instability or potentially be chained with other vulnerabilities for more severe impacts.

Detection Methods for CVE-2026-23099

Indicators of Compromise

• KASAN reports in kernel logs indicating global-out-of-bounds reads in __hw_addr_create or __hw_addr_add_ex
• Kernel oops or panics originating from net/core/dev_addr_lists.c during bonding configuration
• System crashes when adding non-Ethernet interfaces to 802.3ad bonding groups
• Unexpected netlink socket activity related to bonding interface configuration

Detection Strategies

• Monitor kernel logs for KASAN violations referencing lacpdu_mcast_addr or the bonding driver
• Enable kernel address sanitizer (KASAN) in development/testing environments to detect exploitation attempts
• Implement audit rules for netlink RTM_NEWLINK messages that configure bonding interfaces
• Deploy endpoint detection solutions capable of monitoring kernel-level memory access patterns

Monitoring Recommendations

• Configure syslog aggregation to capture kernel oops and KASAN reports from all systems running bonded network interfaces
• Use SentinelOne Singularity Platform to monitor for anomalous kernel behavior and memory access violations
• Implement alerting for unexpected changes to network bonding configurations via netlink
• Review system logs for failed or unusual bonding interface creation attempts

How to Mitigate CVE-2026-23099

Immediate Actions Required

• Apply the latest kernel patches that add device type validation for BOND_MODE_8023AD
• Audit existing bonding configurations to ensure only Ethernet interfaces are used with 802.3ad mode
• Restrict access to network configuration capabilities (CAP_NET_ADMIN) to trusted administrators only
• Consider temporarily avoiding 802.3ad bonding mode until patches are applied in critical environments

Patch Information

The Linux kernel development team has released patches addressing this vulnerability. The fix adds a validation check to ensure that BOND_MODE_8023AD is only permitted for ARPHRD_ETHER (Ethernet) device types. Multiple commits have been merged to stable kernel branches:

• Kernel Git Commit 43dee6f
• Kernel Git Commit 80c881e
• Kernel Git Commit c84fcb7
• Kernel Git Commit ef68afb

Update to a kernel version containing these fixes to fully remediate the vulnerability.

Workarounds

• Only configure bonding interfaces with 802.3ad mode using verified Ethernet (ARPHRD_ETHER) devices
• Implement network namespace isolation to limit bonding configuration access
• Use alternative bonding modes (e.g., balance-rr, active-backup) for non-Ethernet interfaces where link aggregation is required
• Apply mandatory access control policies (SELinux/AppArmor) to restrict network interface configuration operations

# Verify bonding interface device types before configuration
# Check that all slave interfaces are Ethernet (type 1 = ARPHRD_ETHER)
ip -d link show bond0
cat /sys/class/net/eth0/type  # Should return 1 for Ethernet

# Restrict bonding module to prevent misconfiguration
# Add to /etc/modprobe.d/bonding.conf
options bonding mode=802.3ad