{ "affected": [ { "ranges": [ { "events": [ { "introduced": "4e5bd03ae34652cd932ab4c91c71c511793df75c" }, { "fixed": "2de5c8eea0a9db99dae7c36f4b541b74b41d3a04" }, { "fixed": "a0f661918edc79d7a75e468128af8d41e2a1a83a" }, { "fixed": "d4cc7e4c80b1634c7b1497574a2fdb18df6c026c" }, { "fixed": "f5b94654a4a19891a8108d66ef166de6c028c6cd" }, { "fixed": "2884bf72fb8f03409e423397319205de48adca16" } ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "type": "GIT" }, { "events": [ { "introduced": "0" }, { "last_affected": "20949c3816463e97c6f8fe84c0280c7e5ae83a8d" }, { "last_affected": "f1d206181f19b00b275b258fea1418718a2f4173" }, { "last_affected": "c1f1691ef84fa6d38fa5e5148eca073145e97ffa" } ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "type": "GIT" }, { "events": [ { "introduced": "5.10.94" }, { "fixed": "5.11" } ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "type": "GIT" }, { "events": [ { "introduced": "5.15.17" }, { "fixed": "5.16" } ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "type": "GIT" }, { "events": [ { "introduced": "5.16.3" }, { "fixed": "5.17" } ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "type": "GIT" } ] }, { "package": { "ecosystem": "Linux", "name": "Kernel" }, "ranges": [ { "events": [ { "introduced": "5.17.0" }, { "fixed": "6.6.143" } ], "type": "ECOSYSTEM" }, { "events": [ { "introduced": "6.7.0" }, { "fixed": "6.12.95" } ], "type": "ECOSYSTEM" }, { "events": [ { "introduced": "6.13.0" }, { "fixed": "6.18.22" } ], "type": "ECOSYSTEM" }, { "events": [ { "introduced": "6.19.0" }, { "fixed": "6.19.12" } ], "type": "ECOSYSTEM" } ] } ], "database_specific": { "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31419.json" }, "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix use-after-free in bond_xmit_broadcast()\n\nbond_xmit_broadcast() reuses the original skb for the last slave\n(determined by bond_is_last_slave()) and clones it for others.\nConcurrent slave enslave/release can mutate the slave list during\nRCU-protected iteration, changing which slave is \"last\" mid-loop.\nThis causes the original skb to be double-consumed (double-freed).\n\nReplace the racy bond_is_last_slave() check with a simple index\ncomparison (i + 1 == slaves_count) against the pre-snapshot slave\ncount taken via READ_ONCE() before the loop. This preserves the\nzero-copy optimization for the last slave while making the \"last\"\ndetermination stable against concurrent list mutations.\n\nThe UAF can trigger the following crash:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in skb_clone\nRead of size 8 at addr ffff888100ef8d40 by task exploit/147\n\nCPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl (lib/dump_stack.c:123)\n print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n kasan_report (mm/kasan/report.c:597)\n skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108)\n bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334)\n bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593)\n dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887)\n __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838)\n ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136)\n ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219)\n ip6_output (net/ipv6/ip6_output.c:250)\n ip6_send_skb (net/ipv6/ip6_output.c:1985)\n udp_v6_send_skb (net/ipv6/udp.c:1442)\n udpv6_sendmsg (net/ipv6/udp.c:1733)\n __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206)\n __x64_sys_sendto (net/socket.c:2209)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n \u003c/TASK\u003e\n\nAllocated by task 147:\n\nFreed by task 147:\n\nThe buggy address belongs to the object at ffff888100ef8c80\n which belongs to the cache skbuff_head_cache of size 224\nThe buggy address is located 192 bytes inside of\n freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60)\n\nMemory state around the buggy address:\n ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc\n ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003effff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\n ^\n ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb\n ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n==================================================================", "id": "CVE-2026-31419", "modified": "2026-07-10T03:54:33.674010937Z", "published": "2026-04-13T13:40:23.279Z", "references": [ { "type": "WEB", "url": "https://git.kernel.org/stable/c/2884bf72fb8f03409e423397319205de48adca16" }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/2de5c8eea0a9db99dae7c36f4b541b74b41d3a04" }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/a0f661918edc79d7a75e468128af8d41e2a1a83a" }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/d4cc7e4c80b1634c7b1497574a2fdb18df6c026c" }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/f5b94654a4a19891a8108d66ef166de6c028c6cd" }, { "type": "WEB", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31419.json" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:13566" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:19521" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:21209" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:22334" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:22900" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:22940" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:23224" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:25191" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:25217" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:27353" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:27354" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:35870" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:36172" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:36530" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:36531" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:36532" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:36533" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:36534" }, { "type": "ADVISORY", "url": "https://access.redhat.com/security/cve/CVE-2026-31419" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31419.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31419" }, { "type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457829" }, { "type": "PACKAGE", "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git" } ], "schema_version": "1.7.5", "severity": [ { "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "net: bonding: fix use-after-free in bond_xmit_broadcast()" }