All vulnerabilities
CVE-2026-98089

Linux: bonding: alb: fix uninitialized transport header access in alb_determine_nd()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in862c8eb6947689c44fe11353755576a3672563a5Also 7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99, 27314f96d29b54e815e7a9b84c3273f1895e68e2 and 2 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 862c8eb6947689c44fe11353755576a3672563a5LinuxCVE List
  • 7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99LinuxCVE List
  • 27314f96d29b54e815e7a9b84c3273f1895e68e2LinuxCVE List
  • 3b178894931a268c09126a5b53630f343e10e296LinuxCVE List
  • 70f3995830d3f1e79faa14eb0605914f778feca9LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bonding: alb: fix uninitialized transport header access in alb_determine_nd()

alb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers. However, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets or forwarded packets), skb->transport_header is not guaranteed to be initialized. While pskb_network_may_pull() ensures the packet data is linear starting from the network header, it does not set or adjust the transport header offset.

Dereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory.

Fetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(), and reload ipv6hdr in case pskb_may_pull() reallocated skb->head. Also remove the unused bond argument from alb_determine_nd().

Text from CVE List

Affected versions 14

  • Linuxaffected: 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 before 862c8eb6947689c44fe11353755576a3672563a5CVE List
  • Linuxaffected: 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 before 7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99CVE List
  • Linuxaffected: 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 before e39cf90bd856443542b97933289749fca07476bfCVE List
  • Linuxaffected: 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 before 27314f96d29b54e815e7a9b84c3273f1895e68e2CVE List
  • Linuxaffected: 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 before 3b178894931a268c09126a5b53630f343e10e296CVE List
  • Linuxaffected: 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 before 70f3995830d3f1e79faa14eb0605914f778feca9CVE List
  • Linuxaffected: 5.18CVE List
  • Linuxunaffected: all versions before 5.18CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 6