CVE-2026-52975: Linux Kernel Race Condition Vulnerability

CVE-2026-52975 Overview

CVE-2026-52975 is a kernel race condition in the Linux bonding driver's IEEE 802.3ad (LACP) implementation. The Kernel Concurrency Sanitizer (KCSAN), triggered by syzbot, reported a data race between bond_3ad_get_active_agg_info and bond_3ad_state_machine_handler accessing port->aggregator without proper Read-Copy-Update (RCU) protection. The fix adds the __rcu qualifier to port->aggregator and converts accesses to use the RCU API. The flaw exists in drivers/net/bonding/bond_3ad.c, where one task writes to the aggregator pointer in ad_port_selection_logic while another concurrently reads it through netlink path bond_fill_info.

Critical Impact
Concurrent unsynchronized access to port->aggregator can yield torn reads, stale aggregator pointers, and inconsistent LACP state, potentially destabilizing bonded network interfaces on multi-CPU Linux hosts.

Affected Products

Linux kernel bonding driver (drivers/net/bonding/bond_3ad.c)
Systems configured with IEEE 802.3ad (LACP) bonded interfaces
Kernel versions prior to the fixes referenced in commits 3b7265b, 78f409f, ba2272b, c169c5b, and c4f050c

Discovery Timeline

2026-06-24 - CVE-2026-52975 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52975

Vulnerability Analysis

The Linux bonding driver implements link aggregation per IEEE 802.3ad (LACP), where each slave port tracks its current aggregator membership. The state machine worker thread updates port->aggregator inside ad_port_selection_logic at bond_3ad.c:1659, invoked via bond_3ad_state_machine_handler. Concurrently, the netlink path can read the same pointer via __bond_3ad_get_active_agg_info and bond_3ad_get_active_agg_info during bond_fill_info calls servicing RTM_NEWLINK and similar requests.

Neither side held a lock or used RCU primitives, producing an unsynchronized pointer load and store on an 8-byte field. KCSAN flagged the write at offset 0xffff88813cf5c4b0 from the workqueue context against a concurrent read from sendmsg-driven netlink processing.

Root Cause

The port->aggregator field lacked the __rcu annotation and was accessed with plain C loads and stores. Updates were not published with rcu_assign_pointer, and readers did not use rcu_dereference inside an RCU read-side critical section. This is a classic data race: a non-atomic pointer publication observed by lockless readers.

Attack Vector

Exploitation is local. A user with the ability to issue netlink RTM_GETLINK or RTM_NEWLINK requests against a bonded interface can race the LACP state machine worker. The resulting torn read or stale pointer can surface as inconsistent LACP status reporting, transient misrouting between aggregators, or follow-on memory safety hazards if a freed aggregator object is dereferenced. The vendor classifies this as a concurrency defect rather than a confirmed memory-corruption primitive.

The fix qualifies port->aggregator with __rcu, replaces direct assignments with rcu_assign_pointer, and wraps reads in rcu_dereference under rcu_read_lock(). No public exploit code is referenced, and no proof-of-concept has been published beyond the syzbot KCSAN report.

Detection Methods for CVE-2026-52975

Indicators of Compromise

KCSAN warnings naming bond_3ad_get_active_agg_info and bond_3ad_state_machine_handler on hosts running debug kernels
Kernel logs reporting inconsistent LACP aggregator state on bonded interfaces (bond0, bond1)
Unexpected RTM_NEWLINK events showing aggregator transitions without corresponding link events

Detection Strategies

Audit kernel package versions across the fleet and compare against the stable trees containing commits 3b7265b, 78f409f, ba2272b, c169c5b, and c4f050c
Enable KCSAN on canary or test hosts to surface residual races in bonding code paths during regression testing
Inventory hosts using 802.3ad mode by querying /proc/net/bonding/* and /sys/class/net/*/bonding/mode

Monitoring Recommendations

Forward dmesg and journald kernel facility entries to a central log store and alert on KCSAN, bond_3ad, and ad_port_selection_logic strings
Track netlink activity from unprivileged user namespaces, which can reach the affected code paths
Baseline LACP partner state transitions and alert on rapid aggregator churn that may indicate triggered races

How to Mitigate CVE-2026-52975

Immediate Actions Required

Identify all Linux hosts running bonded interfaces in 802.3ad (LACP) mode and prioritize them for patching
Apply the distribution kernel update that includes the upstream fix, or rebuild from a stable tree containing the referenced commits
Reboot patched hosts to load the corrected bonding driver, as live patching of bonding internals is not generally supported

Patch Information

Upstream fixes are available in the Linux kernel stable tree. Reference commits: Kernel Git Commit 3b7265b, Kernel Git Commit 78f409f, Kernel Git Commit ba2272b, Kernel Git Commit c169c5b, and Kernel Git Commit c4f050c. The patches add the __rcu qualifier to port->aggregator and convert all accessors to rcu_assign_pointer and rcu_dereference.

Workarounds

Where patching is delayed, restrict netlink access to bonded interfaces by limiting CAP_NET_ADMIN and disabling unprivileged user namespaces (kernel.unprivileged_userns_clone=0)
Reduce concurrency on the LACP state machine by avoiding frequent ip link set or monitoring tools that poll bonding state at sub-second intervals
Consider switching non-critical bonds to active-backup mode until patched kernels are deployed

bash

# Verify installed kernel and bonding mode after patching
uname -r
for b in /proc/net/bonding/*; do
  echo "=== $b ==="
  grep -E 'Bonding Mode|MII Status|Aggregator' "$b"
done

# Harden netlink exposure on unpatched hosts
sysctl -w kernel.unprivileged_userns_clone=0