CVE-2026-45970: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45970 Overview

CVE-2026-45970 is a use-after-free (UAF) vulnerability in the Linux kernel's bonding driver, specifically in the Adaptive Load Balancing (ALB) receive path. The flaw resides in rlb_arp_recv(), which can access the rx_hashtbl structure concurrently with bond teardown. During rapid bond up/down cycles, rlb_deinitialize() frees rx_hashtbl while RX handlers continue to execute, producing a null pointer dereference detected by Kernel Address Sanitizer (KASAN).

Critical Impact
Local attackers triggering rapid bond interface state changes while ARP traffic is received can cause a kernel use-after-free, leading to denial of service through kernel panic or potential memory corruption.

Affected Products

Linux kernel bonding driver (drivers/net/bonding)
Systems using bond interfaces configured in ALB (mode 6) or TLB (mode 5) modes
Linux kernel versions prior to commits referenced in the stable tree fixes

Discovery Timeline

2026-05-27 - CVE-2026-45970 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45970

Vulnerability Analysis

The vulnerability stems from a race condition between the bonding driver's ALB receive path and bond teardown logic. When a bond interface using ALB mode is torn down, bond_alb_deinitialize() calls rlb_deinitialize() to free the rx_hashtbl structure. However, rlb_arp_recv() remains reachable through the network receive path because clearing the recv_probe callback is not synchronized with in-flight RX processing.

The root cause is that rlb_arp_recv() can still be invoked after recv_probe is set to NULL. This creates a window where RX handlers dereference freed memory belonging to rx_hashtbl. KASAN reports the access as a null pointer dereference in the range 0x00000000000000e8-0x00000000000000ef, occurring within rlb_arp_recv+0x505/0xab0.

This class of defect is categorized as Use After Free, a memory corruption flaw that can produce kernel oops events and, depending on heap state, may allow control-flow influence.

Root Cause

The bonding driver did not call synchronize_net() after clearing recv_probe. Without synchronization, concurrent softirq context RX processing could continue invoking rlb_arp_recv() against an rx_hashtbl that rlb_deinitialize() had already freed. The freed entry was then dereferenced during ARP frame handling inside bond_handle_frame().

Attack Vector

An attacker with the ability to toggle bond interface state, combined with ARP traffic arriving on the bond, can reproduce the race. The reporter triggered the issue by repeatedly running ip link set bond0 up/down while the system received ARP messages. The race occurs in softirq context during __netif_receive_skb_core processing, making the timing window dependent on network load rather than precise attacker timing.

No verified public exploit code is available. The vulnerability is described in prose based on the upstream kernel commit messages and the KASAN trace published with the fix. See the Linux Kernel stable tree commits for the patch implementation.

Detection Methods for CVE-2026-45970

Indicators of Compromise

Kernel oops messages referencing rlb_arp_recv in the call trace
KASAN reports indicating null pointer dereference or use-after-free in the bonding module
Unexpected kernel panics on hosts running bond interfaces in ALB or TLB mode
bond_handle_frame appearing in crash dumps alongside ARP processing functions

Detection Strategies

Enable KASAN on test kernels to surface UAF events in the bonding driver during stress tests
Monitor dmesg and /var/log/kern.log for general protection fault entries involving the bonding module
Collect kdump output from affected hosts and inspect for rlb_arp_recv frames in the panic stack
Track frequency of bond interface state transitions to identify systems exposed to the race window

Monitoring Recommendations

Alert on repeated ip link set operations against bond interfaces from non-administrative contexts
Forward kernel crash telemetry to a centralized SIEM for correlation across the fleet
Track ARP traffic volume on bond-attached interfaces during interface state changes
Audit configuration management changes that frequently bring bond interfaces up or down

How to Mitigate CVE-2026-45970

Immediate Actions Required

Apply the upstream kernel fix that adds synchronize_net() after clearing recv_probe during bond ALB teardown
Inventory hosts using bonding mode 5 (TLB) or mode 6 (ALB) and prioritize them for patching
Restrict the CAP_NET_ADMIN capability so that only trusted operators can toggle bond interface state
Schedule kernel updates on affected distributions once vendors publish backports referencing this CVE

Patch Information

The fix sets recv_probe to NULL and then calls synchronize_net() to wait for any concurrent RX processing to finish before freeing rx_hashtbl in bond_alb_deinitialize(). The patch is available across multiple stable branches via the following commits: c65cdf46, d3106552, db5435b5, de7c0978, e6834a4c, f94a0de7, fd54ddc9, and fef13c40.

Workarounds

Switch bond interfaces from ALB (mode 6) or TLB (mode 5) to alternative modes such as active-backup (mode 1) or 802.3ad (mode 4) where operationally acceptable
Avoid scripted or automated rapid up/down cycling of bond interfaces until the patch is deployed
Limit administrative access to network configuration utilities such as ip and ifenslave

bash

# Configuration example: identify hosts running ALB or TLB bonding modes
for bond in /proc/net/bonding/*; do
    mode=$(awk -F': ' '/Bonding Mode/ {print $2}' "$bond")
    case "$mode" in
        *"adaptive load balancing"*|*"transmit load balancing"*)
            echo "$bond uses vulnerable mode: $mode"
            ;;
    esac
done

# Verify kernel version after patching
uname -r