From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F094E48F852 for ; Fri, 25 Sep 2026 10:36:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790332620; cv=none; b=qZGZXOvEaL+8BlU8QcO5g11ZhGo6t3l5I5VGy0ANVjQJW6QHukFgT/c4FYp+tkmTvP/knOBG+uaH14O5KN9QXbzlU5AZcAn91dnm1jaUOLXoe8XMPZoFOsrcYyfrhxMtWrwko+nnm5DppTiiwDaqpX1rK9r+K1GvaLhGOBcXDZ8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790332620; c=relaxed/simple; bh=gyO/RkmALDniDBw/FjbFuxVMCqmoJdlnquRxewmaxkg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=A+k5U5SfL/tNluBemZyG0Z/4kEY29XyXICD9V5fjqin8T7vpEO/ijdP9UKMhHVY6VCauiwYobr7XJGUAqYUpZviLZ4al+ha+Mr/hnvpsZIqWpkpma6LfFgqEKlj2mWEytE6LOetgtJBeKJ8cuW8aCeaN30gLiD1bPxALORt1Ms4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=oqcQOhAE; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="oqcQOhAE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 508961F000FF; Fri, 25 Sep 2026 10:36:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1790332618; bh=3688T4+7drhISkFIjm2OJpbbkrgwoxDbFd8vLn9vSAY=; h=From:To:Cc:Subject:Date:Reply-To; b=oqcQOhAEADF9Te8i5P4hQqqQ6pYf+eGgsuGdFEk416g1edKskWmGnN+/YAtjEQ/Nz YghWX014QS8VqBXfZUaB5Wj/0sodx3c/blOCOGd5RNUoET+kPw/F+sfoAawgMZGDj9 kqb99H7tq8VoG+Zpvhg5/TgD9/aPv3QhmrWRZpno= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98089: bonding: alb: fix uninitialized transport header access in alb_determine_nd() Date: Fri, 25 Sep 2026 12:26:31 +0200 Message-ID: <2026092539-CVE-2026-98089-e239@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2912; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=lfQpb+P6LGe5+l6aFh9GPkpUhGbZg/85EHY9VvfrcIM=; b=owGbwMvMwCRo6H6F97bub03G02pJDFnbvPMrpdWLMjmXTBd0+nWsTO1Eqm+m1p3TjzZx33Jal dV4TexfRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEzkwQmG+QnRZelf+sU75/77 v/9vaUDa9b3zgxlms8Y4zjlyRuXKuusfUg6Erpf7f2auIgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix uninitialized transport header access in alb_determine_nd() alb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers. However, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets or forwarded packets), skb->transport_header is not guaranteed to be initialized. While pskb_network_may_pull() ensures the packet data is linear starting from the network header, it does not set or adjust the transport header offset. Dereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory. Fetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(), and reload ipv6hdr in case pskb_may_pull() reallocated skb->head. Also remove the unused bond argument from alb_determine_nd(). The Linux kernel CVE team has assigned CVE-2026-98089 to this issue. Affected and fixed versions =========================== Issue introduced in 5.18 with commit 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 and fixed in 6.12.111 with commit e39cf90bd856443542b97933289749fca07476bf Issue introduced in 5.18 with commit 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 and fixed in 6.18.53 with commit 27314f96d29b54e815e7a9b84c3273f1895e68e2 Issue introduced in 5.18 with commit 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 and fixed in 7.2.7 with commit 3b178894931a268c09126a5b53630f343e10e296 Issue introduced in 5.18 with commit 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 and fixed in 7.3-rc2 with commit 70f3995830d3f1e79faa14eb0605914f778feca9 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98089 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/bonding/bond_alb.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/e39cf90bd856443542b97933289749fca07476bf https://git.kernel.org/stable/c/27314f96d29b54e815e7a9b84c3273f1895e68e2 https://git.kernel.org/stable/c/3b178894931a268c09126a5b53630f343e10e296 https://git.kernel.org/stable/c/70f3995830d3f1e79faa14eb0605914f778feca9