CVE-2026-98074

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98074", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.074Z", "datePublished": "2026-09-25T10:24:13.870Z", "dateUpdated": "2026-10-19T09:13:23.911Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:13:23.911Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: do not clear curr_active_slave prematurely when releasing all slaves\n\nWhen releasing all slaves during bond destruction (all == true),\n__bond_release_one() unconditionally clears bond->curr_active_slave to\nNULL in every iteration.\n\nIf a backup slave is released before the active slave,\nbond_alb_deinit_slave() triggers rlb_teach_disabled_mac_on_primary(),\nwhich increments the active slave dev promiscuity counter and sets\nbond_info->primary_is_promisc = 1.\n\nBecause bond->curr_active_slave was prematurely cleared to NULL when\nreleasing the backup slave, the subsequent iteration releasing the active\nslave evaluates oldcurrent as NULL, so bond_change_active_slave(bond, NULL)\nis skipped. Consequently, bond_alb_handle_active_change() is never called\nto decrement the promiscuity counter, permanently leaking promiscuous\nmode on the physical device after bond teardown.\n\nWhen oldcurrent == slave, bond_change_active_slave(bond, NULL) already sets\nbond->curr_active_slave to NULL. We only need to avoid selecting a new\nactive slave when all == true. Replace the if (all) branch with\nif (!all && oldcurrent == slave)."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/bonding/bond_main.c"], "versions": [{"version": "0896341a44bf04bf6149d9307fe4686006f3eee1", "lessThan": "b1ded242135071769902778dbab081e3fc09730f", "status": "affected", "versionType": "git"}, {"version": "0896341a44bf04bf6149d9307fe4686006f3eee1", "lessThan": "e39b203ec9e73852098d41b26386172d51babeb9", "status": "affected", "versionType": "git"}, {"version": "0896341a44bf04bf6149d9307fe4686006f3eee1", "lessThan": "384739c631aa6749356ba062d6b7c9a484a733f6", "status": "affected", "versionType": "git"}, {"version": "0896341a44bf04bf6149d9307fe4686006f3eee1", "lessThan": "7b435c69a30b40efc642de98b9bfa95fcf2ad4f0", "status": "affected", "versionType": "git"}, {"version": "0896341a44bf04bf6149d9307fe4686006f3eee1", "lessThan": "d6ef22e79c2be3612868daede0e9a84f05439d9e", "status": "affected", "versionType": "git"}, {"version": "0896341a44bf04bf6149d9307fe4686006f3eee1", "lessThan": "19ba7ecfade159b3702c78a360fd7d971e2b7109", "status": "affected", "versionType": "git"}, {"version": "0896341a44bf04bf6149d9307fe4686006f3eee1", "lessThan": "6d0ee411d5437f3d126ea6979acb83a8da29dc81", "status": "affected", "versionType": "git"}, {"version": "0896341a44bf04bf6149d9307fe4686006f3eee1", "lessThan": "af602c7aa5fedc9be3043244017aef4f26c96b70", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/bonding/bond_main.c"], "versions": [{"version": "3.9", "status": "affected"}, {"version": "0", "lessThan": "3.9", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b1ded242135071769902778dbab081e3fc09730f"}, {"url": "https://git.kernel.org/stable/c/e39b203ec9e73852098d41b26386172d51babeb9"}, {"url": "https://git.kernel.org/stable/c/384739c631aa6749356ba062d6b7c9a484a733f6"}, {"url": "https://git.kernel.org/stable/c/7b435c69a30b40efc642de98b9bfa95fcf2ad4f0"}, {"url": "https://git.kernel.org/stable/c/d6ef22e79c2be3612868daede0e9a84f05439d9e"}, {"url": "https://git.kernel.org/stable/c/19ba7ecfade159b3702c78a360fd7d971e2b7109"}, {"url": "https://git.kernel.org/stable/c/6d0ee411d5437f3d126ea6979acb83a8da29dc81"}, {"url": "https://git.kernel.org/stable/c/af602c7aa5fedc9be3043244017aef4f26c96b70"}], "title": "bonding: do not clear curr_active_slave prematurely when releasing all slaves", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/bonding/bond_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b1ded242135071769902778dbab081e3fc09730f", "status": "affected", "version": "0896341a44bf04bf6149d9307fe4686006f3eee1", "versionType": "git"}, {"lessThan": "e39b203ec9e73852098d41b26386172d51babeb9", "status": "affected", "version": "0896341a44bf04bf6149d9307fe4686006f3eee1", "versionType": "git"}, {"lessThan": "384739c631aa6749356ba062d6b7c9a484a733f6", "status": "affected", "version": "0896341a44bf04bf6149d9307fe4686006f3eee1", "versionType": "git"}, {"lessThan": "7b435c69a30b40efc642de98b9bfa95fcf2ad4f0", "status": "affected", "version": "0896341a44bf04bf6149d9307fe4686006f3eee1", "versionType": "git"}, {"lessThan": "d6ef22e79c2be3612868daede0e9a84f05439d9e", "status": "affected", "version": "0896341a44bf04bf6149d9307fe4686006f3eee1", "versionType": "git"}, {"lessThan": "19ba7ecfade159b3702c78a360fd7d971e2b7109", "status": "affected", "version": "0896341a44bf04bf6149d9307fe4686006f3eee1", "versionType": "git"}, {"lessThan": "6d0ee411d5437f3d126ea6979acb83a8da29dc81", "status": "affected", "version": "0896341a44bf04bf6149d9307fe4686006f3eee1", "versionType": "git"}, {"lessThan": "af602c7aa5fedc9be3043244017aef4f26c96b70", "status": "affected", "version": "0896341a44bf04bf6149d9307fe4686006f3eee1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/bonding/bond_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.9"}, {"lessThan": "3.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: do not clear curr_active_slave prematurely when releasing all slaves\n\nWhen releasing all slaves during bond destruction (all == true),\n__bond_release_one() unconditionally clears bond->curr_active_slave to\nNULL in every iteration.\n\nIf a backup slave is released before the active slave,\nbond_alb_deinit_slave() triggers rlb_teach_disabled_mac_on_primary(),\nwhich increments the active slave dev promiscuity counter and sets\nbond_info->primary_is_promisc = 1.\n\nBecause bond->curr_active_slave was prematurely cleared to NULL when\nreleasing the backup slave, the subsequent iteration releasing the active\nslave evaluates oldcurrent as NULL, so bond_change_active_slave(bond, NULL)\nis skipped. Consequently, bond_alb_handle_active_change() is never called\nto decrement the promiscuity counter, permanently leaking promiscuous\nmode on the physical device after bond teardown.\n\nWhen oldcurrent == slave, bond_change_active_slave(bond, NULL) already sets\nbond->curr_active_slave to NULL. We only need to avoid selecting a new\nactive slave when all == true. Replace the if (all) branch with\nif (!all && oldcurrent == slave)."}], "id": "CVE-2026-98074", "lastModified": "2026-10-19T10:18:02.950", "metrics": {}, "published": "2026-09-25T11:17:36.730", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/19ba7ecfade159b3702c78a360fd7d971e2b7109"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/384739c631aa6749356ba062d6b7c9a484a733f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6d0ee411d5437f3d126ea6979acb83a8da29dc81"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7b435c69a30b40efc642de98b9bfa95fcf2ad4f0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/af602c7aa5fedc9be3043244017aef4f26c96b70"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b1ded242135071769902778dbab081e3fc09730f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d6ef22e79c2be3612868daede0e9a84f05439d9e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e39b203ec9e73852098d41b26386172d51babeb9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Undergoing Analysis"}

{"bugzilla": {"description": "kernel: bonding: do not clear curr_active_slave prematurely when releasing all slaves", "id": "2541280", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541280"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-459", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbonding: do not clear curr_active_slave prematurely when releasing all slaves\nWhen releasing all slaves during bond destruction (all == true),\n__bond_release_one() unconditionally clears bond->curr_active_slave to\nNULL in every iteration.\nIf a backup slave is released before the active slave,\nbond_alb_deinit_slave() triggers rlb_teach_disabled_mac_on_primary(),\nwhich increments the active slave dev promiscuity counter and sets\nbond_info->primary_is_promisc = 1.\nBecause bond->curr_active_slave was prematurely cleared to NULL when\nreleasing the backup slave, the subsequent iteration releasing the active\nslave evaluates oldcurrent as NULL, so bond_change_active_slave(bond, NULL)\nis skipped. Consequently, bond_alb_handle_active_change() is never called\nto decrement the promiscuity counter, permanently leaking promiscuous\nmode on the physical device after bond teardown.\nWhen oldcurrent == slave, bond_change_active_slave(bond, NULL) already sets\nbond->curr_active_slave to NULL. We only need to avoid selecting a new\nactive slave when all == true. Replace the if (all) branch with\nif (!all && oldcurrent == slave).", "A flaw was found in the Linux kernel's network bonding driver. A local user with network administration privileges can cause a physical network adapter to permanently remain in promiscuous mode (a configuration where an interface captures all traffic on the local network segment, rather than only traffic intended for it). During the teardown of a bonded network interface, the kernel prematurely clears tracking state for the active adapter before secondary interfaces are fully released. This prevents the driver from properly resetting the promiscuity counter, leaving the underlying physical device stuck in promiscuous mode."], "name": "CVE-2026-98074", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98074\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98074\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98074.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0896341a44bf04bf6149d9307fe4686006f3eee1,d6ef22e79c2be3612868daede0e9a84f05439d9e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0896341a44bf04bf6149d9307fe4686006f3eee1,19ba7ecfade159b3702c78a360fd7d971e2b7109)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0896341a44bf04bf6149d9307fe4686006f3eee1,6d0ee411d5437f3d126ea6979acb83a8da29dc81)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0896341a44bf04bf6149d9307fe4686006f3eee1,af602c7aa5fedc9be3043244017aef4f26c96b70)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T16:30:15.786485+00:00", "updated": "2026-09-30T13:45:16.960907+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}