CVE-2026-23099: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-23099 Overview

CVE-2026-23099 is an out-of-bounds read vulnerability in the Linux kernel's bonding driver. The flaw occurs when BOND_MODE_8023AD (IEEE 802.3ad Link Aggregation) is applied to non-Ethernet devices. The bonding code assumes the enslaved device is of type ARPHRD_ETHER and copies the lacpdu_mcast_addr multicast address into the device's address list. When a non-Ethernet interface is enslaved, __hw_addr_create() reads past the bounds of the global lacpdu_mcast_addr variable, triggering a KASAN global-out-of-bounds report. The issue affects Linux kernel 6.19 release candidates and earlier branches, and was reported by syzbot via syzkaller fuzzing.

Critical Impact
A local user with CAP_NET_ADMIN can trigger a kernel out-of-bounds read leading to kernel memory disclosure or denial of service via the bonding netlink interface.

Affected Products

Linux Kernel (multiple stable branches prior to fix)
Linux Kernel 6.19-rc1 through 6.19-rc6
Distributions shipping unpatched bonding driver builds

Discovery Timeline

2026-02-04 - CVE-2026-23099 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-23099

Vulnerability Analysis

The Linux bonding driver implements BOND_MODE_8023AD to support IEEE 802.3ad Link Aggregation Control Protocol (LACP). LACP requires Ethernet framing and a specific multicast destination address (01:80:c2:00:00:02) stored in the kernel symbol lacpdu_mcast_addr. The bonding driver did not validate that an enslaved device used ARPHRD_ETHER before invoking dev_mc_add() with this Ethernet-sized address. When a non-Ethernet interface was enslaved in 802.3ad mode, the kernel attempted to copy the LACPDU multicast address into an address list sized for a different link-layer type. KASAN detected the resulting global-out-of-bounds read in __hw_addr_create() at net/core/dev_addr_lists.c:63.

Root Cause

The root cause is missing input validation in bond_enslave() within drivers/net/bonding/bond_main.c. The function accepted any link-layer type when configuring 802.3ad mode. The fix restricts BOND_MODE_8023AD to interfaces where dev->type == ARPHRD_ETHER, rejecting non-Ethernet slaves before any address-list manipulation occurs. The weakness maps to [CWE-125] Out-of-bounds Read.

Attack Vector

Exploitation requires local access and the CAP_NET_ADMIN capability, which is typically held by root or processes in privileged user namespaces. An attacker sends an RTM_NEWLINK or RTM_SETLINK netlink message via rtnetlink to enslave a non-Ethernet device into a bond configured for 802.3ad mode. The call path proceeds through rtnl_newlink() → do_setlink() → do_set_master() → bond_enslave() → dev_mc_add() → __hw_addr_add_ex() → __hw_addr_create(), where the out-of-bounds memcpy occurs against lacpdu_mcast_addr.

No public proof-of-concept code is available beyond the syzbot reproducer referenced in the kernel commit messages. The vulnerability mechanism is documented in the upstream patches at Kernel Git Commit 80c881e and related backports.

Detection Methods for CVE-2026-23099

Indicators of Compromise

KASAN reports in dmesg referencing global-out-of-bounds in __hw_addr_create or __hw_addr_add_ex with the symbol lacpdu_mcast_addr
Unexpected RTM_NEWLINK netlink messages configuring bond masters over non-Ethernet slave interfaces such as tunnels, IPoIB, or loopback variants
Kernel oops or soft lockup traces originating from bond_enslave+ frames in drivers/net/bonding/bond_main.c

Detection Strategies

Monitor kernel logs for KASAN, BUG, or WARN entries containing bond_enslave or __hw_addr_create call stacks
Audit rtnetlink activity using auditd rules on the socket syscall family to flag unprivileged processes attempting bond master operations
Use eBPF tracing on bond_enslave to record slave device types and detect enslavement attempts against non-ARPHRD_ETHER interfaces

Monitoring Recommendations

Forward kernel ring buffer events to a central log pipeline and alert on KASAN signatures tied to the bonding driver
Track creation of bond interfaces in 802.3ad mode and correlate with the link-layer type of newly added slaves
Baseline the set of users and namespaces holding CAP_NET_ADMIN and alert on capability acquisition by non-administrative workloads

How to Mitigate CVE-2026-23099

Immediate Actions Required

Apply the upstream kernel patches that restrict BOND_MODE_8023AD to ARPHRD_ETHER slaves and rebuild affected hosts
Update to the fixed stable kernel branch shipped by your distribution vendor as soon as patched packages are available
Restrict CAP_NET_ADMIN to trusted administrators and audit user namespaces that grant this capability to unprivileged users

Patch Information

The fix has been merged across multiple stable branches. Reference the upstream commits at Kernel Git Commit 80c881e, Kernel Git Commit 43dee6f, Kernel Git Commit 5063b2c, Kernel Git Commit 72925db, Kernel Git Commit c84fcb7, and Kernel Git Commit ef68afb. The patches add a check in bond_enslave() to reject non-Ethernet devices when the bond operates in 802.3ad mode.

Workarounds

Disable or unload the bonding kernel module on systems that do not require link aggregation: modprobe -r bonding
Avoid configuring bonds in 802.3ad mode over non-Ethernet interfaces such as tunnels, IPoIB, or wireless devices
Constrain access to the rtnetlink interface by removing CAP_NET_ADMIN from container workloads and untrusted user namespaces

bash

# Configuration example: blacklist the bonding module until patched
echo 'install bonding /bin/true' | sudo tee /etc/modprobe.d/disable-bonding.conf
sudo modprobe -r bonding