{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: bonding: fix use-after-free in bond_xmit_broadcast()\\n\\nbond_xmit_broadcast() reuses the original skb for the last slave\\n(determined by bond_is_last_slave()) and clones it for others.\\nConcurrent slave enslave\/release can mutate the slave list during\\nRCU-protected iteration, changing which slave is \\”last\\” mid-loop.\\nThis causes the original skb to be double-consumed (double-freed).\\n\\nReplace the racy bond_is_last_slave() check with a simple index\\ncomparison (i + 1 == slaves_count) against the pre-snapshot slave\\ncount taken via READ_ONCE() before the loop. This preserves the\\nzero-copy optimization for the last slave while making the \\”last\\”\\ndetermination stable against concurrent list mutations.\\n\\nThe UAF can trigger the following crash:\\n\\n==================================================================\\nBUG: KASAN: slab-use-after-free in skb_clone\\nRead of size 8 at addr ffff888100ef8d40 by task exploit\/147\\n\\nCPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY\\nCall Trace:\\n \\u003cTASK\\u003e\\n dump_stack_lvl (lib\/dump_stack.c:123)\\n print_report (mm\/kasan\/report.c:379 mm\/kasan\/report.c:482)\\n kasan_report (mm\/kasan\/report.c:597)\\n skb_clone (include\/linux\/skbuff.h:1724 include\/linux\/skbuff.h:1792 include\/linux\/skbuff.h:3396 net\/core\/skbuff.c:2108)\\n bond_xmit_broadcast (drivers\/net\/bonding\/bond_main.c:5334)\\n bond_start_xmit (drivers\/net\/bonding\/bond_main.c:5567 drivers\/net\/bonding\/bond_main.c:5593)\\n dev_hard_start_xmit (include\/linux\/netdevice.h:5325 include\/linux\/netdevice.h:5334 net\/core\/dev.c:3871 net\/core\/dev.c:3887)\\n __dev_queue_xmit (include\/linux\/netdevice.h:3601 net\/core\/dev.c:4838)\\n ip6_finish_output2 (include\/net\/neighbour.h:540 include\/net\/neighbour.h:554 net\/ipv6\/ip6_output.c:136)\\n ip6_finish_output (net\/ipv6\/ip6_output.c:208 net\/ipv6\/ip6_output.c:219)\\n ip6_output (net\/ipv6\/ip6_output.c:250)\\n ip6_send_skb (net\/ipv6\/ip6_output.c:1985)\\n udp_v6_send_skb (net\/ipv6\/udp.c:1442)\\n udpv6_sendmsg (net\/ipv6\/udp.c:1733)\\n __sys_sendto (net\/socket.c:730 net\/socket.c:742 net\/socket.c:2206)\\n __x64_sys_sendto (net\/socket.c:2209)\\n do_syscall_64 (arch\/x86\/entry\/syscall_64.c:63 arch\/x86\/entry\/syscall_64.c:94)\\n entry_SYSCALL_64_after_hwframe (arch\/x86\/entry\/entry_64.S:130)\\n \\u003c\/TASK\\u003e\\n\\nAllocated by task 147:\\n\\nFreed by task 147:\\n\\nThe buggy address belongs to the object at ffff888100ef8c80\\n which belongs to the cache skbuff_head_cache of size 224\\nThe buggy address is located 192 bytes inside of\\n freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60)\\n\\nMemory state around the buggy address:\\n ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc\\n ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\\n\\u003effff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n ^\\n ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb\\n ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\\n==================================================================”,”published”:”2026-04-13T13:40:23.279Z”,”modified”:”2026-04-27T14:03:01.326Z”,”type”:”cve”,”title”:”net: bonding: fix use-after-free in bond_xmit_broadcast()”,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/d4cc7e4c80b1634c7b1497574a2fdb18df6c026c\\nhttps:\/\/git.kernel.org\/stable\/c\/f5b94654a4a19891a8108d66ef166de6c028c6cd\\nhttps:\/\/git.kernel.org\/stable\/c\/2884bf72fb8f03409e423397319205de48adca16″,”id”:”CVE-2026-31419″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux 4e5bd03ae34652cd932ab4c91c71c511793df75c\\nLinux Linux 4e5bd03ae34652cd932ab4c91c71c511793df75c\\nLinux Linux 4e5bd03ae34652cd932ab4c91c71c511793df75c\\nLinux Linux 20949c3816463e97c6f8fe84c0280c7e5ae83a8d\\nLinux Linux f1d206181f19b00b275b258fea1418718a2f4173\\nLinux Linux c1f1691ef84fa6d38fa5e5148eca073145e97ffa\\nLinux Linux 5.17″,”sourceHref”:””,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”4e5bd03ae34652cd932ab4c91c71c511793df75c”,”vendor”:”Linux”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: bonding: fix use-after-free in bond_xmit_broadcast()\\n\\nbond_xmit_broadcast() reuses the original skb for the last slave\\n(determined by bond_is_last_slave())…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,28,12,15,13,7,11,5],"class_list":["post-49665","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n