linux-cve-announce - CVE-2026-23119: bonding: provide a net pointer to __skb_flow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2026021407-CVE-2026-23119-0f44@gregkh>
Date: Sat, 14 Feb 2026 16:10:11 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2026-23119: bonding: provide a net pointer to __skb_flow_dissect()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

bonding: provide a net pointer to __skb_flow_dissect()

After 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect")
we have to provide a net pointer to __skb_flow_dissect(),
either via skb->dev, skb->sk, or a user provided pointer.

In the following case, syzbot was able to cook a bare skb.

WARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect+0xb57/0x68b0 net/core/flow_dissector.c:1131, CPU#1: syz.2.1418/11053
Call Trace:
 <TASK>
  bond_flow_dissect drivers/net/bonding/bond_main.c:4093 [inline]
  __bond_xmit_hash+0x2d7/0xba0 drivers/net/bonding/bond_main.c:4157
  bond_xmit_hash_xdp drivers/net/bonding/bond_main.c:4208 [inline]
  bond_xdp_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5139 [inline]
  bond_xdp_get_xmit_slave+0x1fd/0x710 drivers/net/bonding/bond_main.c:5515
  xdp_master_redirect+0x13f/0x2c0 net/core/filter.c:4388
  bpf_prog_run_xdp include/net/xdp.h:700 [inline]
  bpf_test_run+0x6b2/0x7d0 net/bpf/test_run.c:421
  bpf_prog_test_run_xdp+0x795/0x10e0 net/bpf/test_run.c:1390
  bpf_prog_test_run+0x2c7/0x340 kernel/bpf/syscall.c:4703
  __sys_bpf+0x562/0x860 kernel/bpf/syscall.c:6182
  __do_sys_bpf kernel/bpf/syscall.c:6274 [inline]
  __se_sys_bpf kernel/bpf/syscall.c:6272 [inline]
  __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:6272
  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
  do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94

The Linux kernel CVE team has assigned CVE-2026-23119 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.5 with commit 58deb77cc52da9360d20676e68dd215742cbe473 and fixed in 5.10.249 with commit 8e53780732ee881394406f79da5263b81eb48f7e
	Issue introduced in 5.5 with commit 58deb77cc52da9360d20676e68dd215742cbe473 and fixed in 5.15.199 with commit 3be945abdd228fd00f6afcf8d137002867a4651b
	Issue introduced in 5.5 with commit 58deb77cc52da9360d20676e68dd215742cbe473 and fixed in 6.1.162 with commit f4faaa1297ecf3255a8591fff2633df05bd5ec84
	Issue introduced in 5.5 with commit 58deb77cc52da9360d20676e68dd215742cbe473 and fixed in 6.6.122 with commit 0efee0b992f28bd5ee01c7a86ef6a307c42eb907
	Issue introduced in 5.5 with commit 58deb77cc52da9360d20676e68dd215742cbe473 and fixed in 6.12.68 with commit bc3c8d2493c6f4d2038844dc8b7ee93de050f7fa
	Issue introduced in 5.5 with commit 58deb77cc52da9360d20676e68dd215742cbe473 and fixed in 6.18.8 with commit de97735a40a144974bf3896ee4cc0270db2e47db
	Issue introduced in 5.5 with commit 58deb77cc52da9360d20676e68dd215742cbe473 and fixed in 6.19 with commit 5f9b329096596b7e53e07d041d7fca4cbe1be752

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-23119
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/bonding/bond_main.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8e53780732ee881394406f79da5263b81eb48f7e
	https://git.kernel.org/stable/c/3be945abdd228fd00f6afcf8d137002867a4651b
	https://git.kernel.org/stable/c/f4faaa1297ecf3255a8591fff2633df05bd5ec84
	https://git.kernel.org/stable/c/0efee0b992f28bd5ee01c7a86ef6a307c42eb907
	https://git.kernel.org/stable/c/bc3c8d2493c6f4d2038844dc8b7ee93de050f7fa
	https://git.kernel.org/stable/c/de97735a40a144974bf3896ee4cc0270db2e47db
	https://git.kernel.org/stable/c/5f9b329096596b7e53e07d041d7fca4cbe1be752