CVE-2026-43456: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43456 Overview

CVE-2026-43456 is a type confusion vulnerability in the Linux kernel bonding driver. The flaw resides in the bond_setup_by_slave() function, which directly copies a slave device's header_ops to the bond device without validation. When a non-Ethernet device such as a Generic Routing Encapsulation (GRE) tunnel is enslaved to a bond, subsequent calls to dev_hard_header() on the bond device invoke header functions like ipgre_header() that rely on netdev_priv(dev) to retrieve device-specific private data. The mismatched private data layout triggers a kernel BUG at net/core/skbuff.c:2306 and an invalid opcode oops.

Critical Impact
Local users able to create network devices can trigger kernel crashes and potential memory corruption through reachable type confusion in the bonding driver.

Affected Products

Linux kernel (upstream, mainline)
Linux kernel stable trees referenced by commits 6ac890f, 950803f, 95597d1, and 9baf26a
Distributions shipping the bonding driver with vulnerable bond_setup_by_slave() logic

Discovery Timeline

2026-05-08 - CVE-2026-43456 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43456

Vulnerability Analysis

The bonding driver supports enslaving heterogeneous network devices. When a non-Ethernet device is the first slave, bond_setup_by_slave() reconfigures the bond device using the slave's operations, including the line bond_dev->header_ops = slave_dev->header_ops;. The bond device then exposes header callbacks that were authored under the assumption they would only ever run against their original device type.

Functions such as ipgre_header() and ip6gre_header() call netdev_priv(dev) to access struct ip_tunnel. When the bond device invokes these callbacks, netdev_priv() returns a pointer to struct bonding instead. The header function reads garbage as if it were tunnel state, corrupting headroom calculations and reaching pskb_expand_head() with invalid parameters, where a BUG() fires.

Root Cause

The root cause is unsafe inheritance of function pointers across devices with incompatible private-data layouts. header_ops callbacks are tightly coupled to netdev_priv() of the originating device, but the bonding driver copied the pointer without supplying the original device context when invoking it.

Attack Vector

A local user with CAP_NET_ADMIN can reproduce the crash using standard iproute2 commands to create a dummy device, a GRE tunnel, and a bond, then enslave the GRE device. Sending a packet through the bond triggers ipgre_header() against the bond device and reaches the BUG. The published reproducer chains ip link add and ip addr add calls with no special privileges beyond network administration in a user namespace.

The upstream fix introduces a bond_header_ops structure containing wrapper functions. Each wrapper delegates to the active slave's header_ops, but passes the slave's own net_device so that netdev_priv() resolves to the correct private data structure. The patch lives in the bonding driver because the inheritance bug is bond-specific and should not be papered over inside every protocol-specific header function.

Detection Methods for CVE-2026-43456

Indicators of Compromise

Kernel panic logs containing kernel BUG at net/core/skbuff.c:2306 with pskb_expand_head in the call trace.
Oops entries showing ipgre_header or ip6gre_header invoked from packet_sendmsg on a bond interface.
Unexpected creation of bond interfaces with non-Ethernet slaves such as gre, gretap, or ip6gre devices.

Detection Strategies

Audit netlinkRTM_NEWLINK events for bond masters acquiring non-Ethernet slave devices, which is unusual in production.
Monitor dmesg and /var/log/kern.log for invalid opcode exceptions originating in net/core/skbuff.c.
Correlate process activity invoking ip link set ... master bond* with subsequent kernel oops events on the same host.

Monitoring Recommendations

Forward kernel ring buffer events into a centralized log pipeline for analytics across the fleet.
Track use of CAP_NET_ADMIN by non-root processes and within unprivileged user namespaces.
Alert on repeated kernel oops or reboots that follow network device manipulation by the same user session.

How to Mitigate CVE-2026-43456

Immediate Actions Required

Apply the upstream stable kernel commits 6ac890f1d60ac3707ee8dae15a67d9a833e49956, 950803f7254721c1c15858fbbfae3deaaeeecb11, 95597d11dc8bddb2b9a051c9232000bfbb5e43ba, and 9baf26a91565b7bb2b1d9f99aaf884a2b28c2f6d.
Pull the corresponding distribution kernel update once your vendor backports the fix.
Restrict CAP_NET_ADMIN and disable unprivileged user namespaces where they are not required.

Patch Information

The fix introduces bond_header_ops wrappers that route header operations through the active slave device. Patch details are available in the upstream commits: Linux Kernel Commit 6ac890f, Linux Kernel Commit 950803f, Linux Kernel Commit 95597d1, and Linux Kernel Commit 9baf26a.

Workarounds

Prevent enslaving non-Ethernet devices such as GRE tunnels into bond interfaces until the patch is deployed.
Set kernel.unprivileged_userns_clone=0 to block unprivileged users from gaining CAP_NET_ADMIN inside user namespaces.
Use Mandatory Access Control (SELinux or AppArmor) policies to limit which processes can invoke ip link operations on bond devices.

bash

# Configuration example
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-cve-2026-43456.conf