CVE-2026-43441: Linux Kernel Bonding DoS Vulnerability

CVE-2026-43441 Overview

CVE-2026-43441 is a NULL pointer dereference vulnerability in the Linux kernel's bonding driver. The flaw occurs when the kernel boots with the ipv6.disable=1 parameter and bonding ARP/NS validation is enabled. Under these conditions, the neighbor discovery table (nd_tbl) is never initialized because inet6_init() exits before ndisc_init() runs. An incoming IPv6 Neighbor Solicitation or Neighbor Advertisement packet on a slave interface reaches bond_validate_na(), which calls bond_has_this_ip6() and ultimately __ipv6_chk_addr_and_flags(), triggering a kernel oops.

Critical Impact
A remote attacker on the same broadcast segment can trigger a kernel crash (denial of service) by sending crafted IPv6 NS/NA packets to a bond slave on a system booted with IPv6 disabled.

Affected Products

Linux kernel with the bonding driver compiled and ipv6.disable=1 boot parameter
Systems using bonding ARP/NS validation on slave interfaces
Stable kernel trees referenced by patch commits 30021e96, 49dbfcbc, 95faa145, c78f01ab, c9c23806, and cf6099ef

Discovery Timeline

2026-05-08 - CVE-2026-43441 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43441

Vulnerability Analysis

The Linux kernel bonding driver supports ARP and Neighbor Solicitation (NS) validation to verify link health. When ARP/NS validation is enabled, the driver inspects IPv6 NS and Neighbor Advertisement (NA) packets received on slave interfaces and confirms the target address is configured locally.

Validation flows through bond_rcv_validate() into bond_validate_na(), which calls bond_has_this_ip6(). That helper invokes ipv6_chk_addr() and __ipv6_chk_addr_and_flags(), both of which dereference the global neighbor discovery table nd_tbl. When IPv6 is disabled at boot, inet6_init() returns early and ndisc_init() never executes, leaving nd_tbl uninitialized.

The call stack captured in the oops shows the fault in softirq context during __netif_receive_skb_core, confirming the crash is triggered by inbound packet processing. The faulting address 0x5d8 corresponds to a structure offset accessed through a NULL table pointer [CWE-476].

Root Cause

The bonding driver dispatches IPv6 packets to the NA validation path without first checking whether the IPv6 subsystem is loaded. The code assumes nd_tbl is always initialized when bonding receives an IPv6 frame, but the ipv6.disable=1 boot parameter breaks that assumption.

Attack Vector

An attacker with Layer 2 access to a network segment containing a vulnerable host can send a single crafted IPv6 NS or NA packet to a bonded slave interface. No authentication or user interaction is required. The packet drives the kernel through bond_handle_frame() into bond_validate_na(), dereferences NULL, and panics the system. The fix adds an ipv6_mod_enabled() check in bond_rcv_validate() so IPv6 packets return early when the IPv6 module is disabled.

The vulnerability manifests entirely in kernel network receive processing. See the upstream commits referenced in the Linux Kernel Git Repository for the exact patch logic.

Detection Methods for CVE-2026-43441

Indicators of Compromise

Kernel oops messages containing __ipv6_chk_addr_and_flags+0x69/0x170 in the call trace
Crash signatures referencing bond_validate_na, bond_rcv_validate, and bond_handle_frame in dmesg or /var/log/kern.log
Unexpected reboots or panics on hosts booted with ipv6.disable=1 and configured with bonding ARP/NS validation

Detection Strategies

Audit kernel command lines (/proc/cmdline) for ipv6.disable=1 combined with bonding configurations that set arp_validate or NS validation
Inspect /proc/net/bonding/<bond> to confirm whether ARP/NS validation is active on each bond interface
Correlate kernel crash dumps with the call signature listed above using centralized log collection

Monitoring Recommendations

Forward kernel ring buffer logs and crash dumps to a centralized logging platform for pattern matching against the oops signature
Track unplanned host reboots on systems running the bonding driver to identify possible exploitation attempts
Monitor IPv6 NS/NA traffic volume to bonded slaves on hosts where IPv6 is administratively disabled

How to Mitigate CVE-2026-43441

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 30021e96, 49dbfcbc, 95faa145, c78f01ab, c9c23806, and cf6099ef from the Linux Kernel Git Repository
Update to a distribution kernel that includes the fix to bond_rcv_validate()
Inventory hosts that boot with ipv6.disable=1 and use the bonding driver with ARP/NS validation enabled

Patch Information

The fix adds an ipv6_mod_enabled() check before dispatching IPv6 packets to bond_na_rcv(). If IPv6 is disabled, bond_rcv_validate() returns early and avoids the path to ipv6_chk_addr(). The patch was committed to multiple stable kernel branches; see the Kernel Git Commit cf6099ef reference for the canonical change.

Workarounds

Disable ARP/NS validation on bond interfaces by setting arp_validate=none until the kernel patch can be deployed
Remove the ipv6.disable=1 boot parameter and instead disable IPv6 via sysctl (net.ipv6.conf.all.disable_ipv6=1), which leaves nd_tbl initialized
Apply ingress filtering at the switch or upstream firewall to block untrusted IPv6 NS/NA traffic to bonded hosts

bash

# Temporary mitigation: disable ARP/NS validation on bond0
ip link set bond0 down
echo 0 > /sys/class/net/bond0/bonding/arp_validate
ip link set bond0 up

# Alternative: disable IPv6 via sysctl instead of kernel cmdline
sysctl -w net.ipv6.conf.all.disable_ipv6=1
sysctl -w net.ipv6.conf.default.disable_ipv6=1