CVE-2026-74726 Overview
CVE-2026-74726 is a race condition in the Linux kernel bonding driver's Adaptive Load Balancing (ALB) monitor. The flaw exists in bond_alb_monitor() within drivers/net/bonding/bond_alb.c. The monitor reads primary_is_promisc under Read-Copy-Update (RCU), drops RCU, then acquires the routing netlink (RTNL) lock via rtnl_trylock(). Between these operations, the active slave state can change, leaving the monitor operating on stale data. Exploitation triggers a general protection fault via null-pointer dereference or underflows the promiscuity counter of a replacement slave, pinning it in IFF_PROMISC mode.
Critical Impact
Local attackers with the ability to manipulate bonding interfaces can trigger a kernel panic or corrupt network interface state, resulting in denial of service on affected Linux systems.
Affected Products
- Linux kernel bonding driver (drivers/net/bonding/bond_alb.c)
- Systems configured with bonded network interfaces in ALB mode
- Multiple stable kernel branches referenced across eight upstream fix commits
Discovery Timeline
- 2026-08-22 - CVE-2026-74726 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74726
Vulnerability Analysis
The bonding driver supports several load-balancing modes including ALB, which manages MAC-level load distribution across slave interfaces. The ALB monitor periodically evaluates slave state and toggles promiscuous mode on the active slave when required. This monitor originally captured primary_is_promisc under RCU protection but performed the corresponding dev_set_promiscuity(-1) call after transitioning to the RTNL lock. This lock handoff creates a Time-of-Check Time-of-Use (TOCTOU) window.
During the window, an administrator or automated agent can remove or replace the active slave through RTM_DELLINK, which invokes __bond_release_one() and bond_alb_handle_active_change(). That path already decrements promiscuity and clears primary_is_promisc. When the monitor resumes with stale state, it either dereferences a now-NULL curr_active_slave or decrements the promiscuity counter of a different slave.
Root Cause
The root cause is inconsistent locking discipline in bond_alb_monitor(). Decisions made under RCU are acted upon after acquiring RTNL without re-validating the state under the new lock. Peer monitors such as bond_miimon_commit() and bond_ab_arp_commit() correctly re-read state during their commit phase, but the ALB monitor did not.
Attack Vector
Exploitation requires local privileges sufficient to manipulate bonding configuration or trigger slave removal events via netlink. Concurrent execution of the ALB monitor workqueue and an RTM_DELLINK on the active slave produces the crash. The reported kernel trace shows KASAN: null-ptr-deref at bond_alb.c:1600 inside the bond_alb_monitor workqueue, followed by fatal kernel panic. Alternatively, when a failover occurs during the window, the underflow of the promiscuity counter locks the new slave into promiscuous mode, degrading network isolation.
No public proof-of-concept is currently referenced in the NVD entry. The vulnerability manifests only in bonding configurations using ALB mode with active slave churn.
Detection Methods for CVE-2026-74726
Indicators of Compromise
- Kernel oops or general protection fault referencing bond_alb_monitor in the workqueue call stack
- KASAN: null-ptr-deref reports pointing to drivers/net/bonding/bond_alb.c around line 1600
- Unexpected persistence of the IFF_PROMISC flag on bonding slave interfaces after failover events
Detection Strategies
- Correlate kernel log messages containing bond_alb_monitor with recent RTM_DELLINK netlink activity against bonded slaves
- Monitor ip link show output for slaves that remain in PROMISC state without administrative justification
- Alert on kernel panics originating from workqueue contexts named bond_alb_monitor
Monitoring Recommendations
- Ingest kernel ring buffer (dmesg) and journald records into a centralized logging pipeline for oops pattern detection
- Track netlink RTM_DELLINK and RTM_NEWLINK events on bond master interfaces for anomalous frequency
- Baseline promiscuity counter values on bonded interfaces to detect underflow-induced pinning
How to Mitigate CVE-2026-74726
Immediate Actions Required
- Apply the upstream stable kernel patches referenced in the NVD advisory to all bonding-enabled hosts
- Restrict CAP_NET_ADMIN privileges to trusted operators to limit who can initiate slave removal or bond reconfiguration
- Reboot systems into patched kernels; hot-patching is not viable for this driver change
Patch Information
The upstream fix re-checks primary_is_promisc and curr_active_slave after acquiring RTNL, ensuring the monitor only undoes an increment it still owns. Backports are available across multiple stable branches. See the upstream commits: Kernel Git Commit 09add8d, Kernel Git Commit 257c4a3, Kernel Git Commit 2faf75a, Kernel Git Commit 683c6ba, Kernel Git Commit b82f516, Kernel Git Commit dccec02, Kernel Git Commit dd14853, and Kernel Git Commit f766876.
Workarounds
- Where operationally feasible, switch bonding mode from ALB (balance-alb) to a mode not affected by this monitor path, such as active-backup or 802.3ad
- Avoid dynamic slave removal on production bonds until patches are applied
- Constrain access to netlink interfaces and bonding sysfs paths using kernel security modules such as SELinux or AppArmor
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
