All vulnerabilities
CVE-2026-98966

Linux: bonding: fix the program leak when XDP is replaced

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in184b5ddf82d45d6f75cc83719a2e453392512bd2Fixed versionCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 184b5ddf82d45d6f75cc83719a2e453392512bd2LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bonding: fix the program leak when XDP is replaced

We need to release the reference on the old BPF prog, whether we are going to no-prog, or replacing the prog with another.

Spotted by AI while running tests for the propagation series (leaked programs were accumulating). Selftest will come in the net-next series to avoid conflicts.

Text from CVE List

Affected versions 6

  • Linuxaffected: 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e before bba6b1b086f9f4ddbfdaba7ea6279dc3abec70c7CVE List
  • Linuxaffected: 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e before 184b5ddf82d45d6f75cc83719a2e453392512bd2CVE List
  • Linuxaffected: 5.15CVE List
  • Linuxunaffected: all versions before 5.15CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2