CVE-2026-98074
Description
In the Linux kernel, the following vulnerability has been resolved: bonding: do not clear curr_active_slave prematurely when releasing all slaves When releasing all slaves during bond destruction (all == true), __bond_release_one() unconditionally clears bond->curr_active_slave to NULL in every iteration. If a backup slave is released before the active slave, bond_alb_deinit_slave() triggers rlb_teach_disabled_mac_on_primary(), which increments the active slave dev promiscuity counter and sets bond_info->primary_is_promisc = 1. Because bond->curr_active_slave was prematurely cleared to NULL when releasing the backup slave, the subsequent iteration releasing the active slave evaluates oldcurrent as NULL, so bond_change_active_slave(bond, NULL) is skipped. Consequently, bond_alb_handle_active_change() is never called to decrement the promiscuity counter, permanently leaking promiscuous mode on the physical device after bond teardown. When oldcurrent == slave, bond_change_active_slave(bond, NULL) already sets bond->curr_active_slave to NULL. We only need to avoid selecting a new active slave when all == true. Replace the if (all) branch with if (!all && oldcurrent == slave).
How to fix
- Linux Linuxb1ded242135071769902778dbab081e3fc09730f, e39b203ec9e73852098d41b26386172d51babeb9, 384739c631aa6749356ba062d6b7c9a484a733f6, 7b435c69a30b40efc642de98b9bfa95fcf2ad4f0, d6ef22e79c2be3612868daede0e9a84f05439d9e, 19ba7ecfade159b3702c78a360fd7d971e2b7109, 6d0ee411d5437f3d126ea6979acb83a8da29dc81, af602c7aa5fedc9be3043244017aef4f26c96b70 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 0896341a44bf04bf6149d9307fe4686006f3eee1 ≤ v < b1ded242135071769902778dbab081e3fc09730f, 0896341a44bf04bf6149d9307fe4686006f3eee1 ≤ v < e39b203ec9e73852098d41b26386172d51babeb9, 0896341a44bf04bf6149d9307fe4686006f3eee1 ≤ v < 384739c631aa6749356ba062d6b7c9a484a733f6, 0896341a44bf04bf6149d9307fe4686006f3eee1 ≤ v < 7b435c69a30b40efc642de98b9bfa95fcf2ad4f0, 0896341a44bf04bf6149d9307fe4686006f3eee1 ≤ v < d6ef22e79c2be3612868daede0e9a84f05439d9e, 0896341a44bf04bf6149d9307fe4686006f3eee1 ≤ v < 19ba7ecfade159b3702c78a360fd7d971e2b7109, 0896341a44bf04bf6149d9307fe4686006f3eee1 ≤ v < 6d0ee411d5437f3d126ea6979acb83a8da29dc81, 0896341a44bf04bf6149d9307fe4686006f3eee1 ≤ v < af602c7aa5fedc9be3043244017aef4f26c96b70, 3.9 | b1ded242135071769902778dbab081e3fc09730f, e39b203ec9e73852098d41b26386172d51babeb9, 384739c631aa6749356ba062d6b7c9a484a733f6, 7b435c69a30b40efc642de98b9bfa95fcf2ad4f0, d6ef22e79c2be3612868daede0e9a84f05439d9e, 19ba7ecfade159b3702c78a360fd7d971e2b7109, 6d0ee411d5437f3d126ea6979acb83a8da29dc81, af602c7aa5fedc9be3043244017aef4f26c96b70 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.