From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9B7E43F0ABA for ; Fri, 8 May 2026 14:27:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778250443; cv=none; b=mF3rMsfO8h06/ZwNwH8759JXq823yf99K44oxPqhAwEvIVZF+/3gKAgbkozI98Akk74H8WWg1I2gFZc6yogbI/o2Fdfq4fsV5DzWGtN0NHPBnKeGBTuCvt8eQp65+lXGQTYBFPQTPNemlkJ7lRWLIqC+9S/6be+S0W50xiMQUm0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778250443; c=relaxed/simple; bh=Brp20xT5ijW7uF3hwAjYozXsaG+7u45/6iIa9riTEkg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=NqA7FSTp02HtdmpJ1nJJpunVPcwPvvKvL5zyauo9LpVrhIpfmqABpjHVLPZj6E2pCJ3oZHuCASd2LwA0T5Y+I5SBF0JBCNTeCNxqaIR+TxGKIzBvXbMkrZ0tpUFdjek+znNjVr8Gby/n75dhazmBS91uCSMBussfJIN+OCwu0k0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0jKHDeZ3; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="0jKHDeZ3" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B8EB9C2BCB0; Fri, 8 May 2026 14:27:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1778250443; bh=Brp20xT5ijW7uF3hwAjYozXsaG+7u45/6iIa9riTEkg=; h=From:To:Cc:Subject:Date:Reply-To:From; b=0jKHDeZ33n3blll0BsTuqUpHJmog2fDSx7pL9dQ7v/aF9n+WAIrFue0bgAuDZyzOZ b48TDxsbX21E6n7VKrmwk9st5vE5hTDHQKdDo0W1uL69EfcHowwoSqB/MMT8d8jnyL 6Koncje8z1T2dmSIMj1tFped8TV1Hlwm1xifsg0E= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() Date: Fri, 8 May 2026 16:23:05 +0200 Message-ID: <2026050859-CVE-2026-43456-ae60@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5077; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=HZyGoXAzUVypbKMSqeqhmRX+OeK7Cq14H3ET/UH867I=; b=owGbwMvMwCRo6H6F97bub03G02pJDJl/P7bf2H4kmcsws/Zg1OfUr/Ne1rEy/LFSbODcsfl03 zOPJbK7O2JZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAiFz8wzC9ff6DTios7Qc/h m1r9e3WfezMKpRgWzEqdf8og+OTPRrMvH/a3R61d+EtEAwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: bonding: fix type confusion in bond_setup_by_slave() kernel BUG at net/core/skbuff.c:2306! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306 RSP: 0018:ffffc90004aff760 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900 RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000 R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780 R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0 Call Trace: ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900 dev_hard_header include/linux/netdevice.h:3439 [inline] packet_snd net/packet/af_packet.c:3028 [inline] packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646 __sys_sendmsg+0x170/0x220 net/socket.c:2678 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe1a0e6c1a9 When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond, bond_setup_by_slave() directly copies the slave's header_ops to the bond device: bond_dev->header_ops = slave_dev->header_ops; This causes a type confusion when dev_hard_header() is later called on the bond device. Functions like ipgre_header(), ip6gre_header(),all use netdev_priv(dev) to access their device-specific private data. When called with the bond device, netdev_priv() returns the bond's private data (struct bonding) instead of the expected type (e.g. struct ip_tunnel), leading to garbage values being read and kernel crashes. Fix this by introducing bond_header_ops with wrapper functions that delegate to the active slave's header_ops using the slave's own device. This ensures netdev_priv() in the slave's header functions always receives the correct device. The fix is placed in the bonding driver rather than individual device drivers, as the root cause is bond blindly inheriting header_ops from the slave without considering that these callbacks expect a specific netdev_priv() layout. The type confusion can be observed by adding a printk in ipgre_header() and running the following commands: ip link add dummy0 type dummy ip addr add 10.0.0.1/24 dev dummy0 ip link set dummy0 up ip link add gre1 type gre local 10.0.0.1 ip link add bond1 type bond mode active-backup ip link set gre1 master bond1 ip link set gre1 up ip link set bond1 up ip addr add fe80::1/64 dev bond1 The Linux kernel CVE team has assigned CVE-2026-43456 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.24 with commit 1284cd3a2b740d0118458d2ea470a1e5bc19b187 and fixed in 6.12.78 with commit 9baf26a91565b7bb2b1d9f99aaf884a2b28c2f6d Issue introduced in 2.6.24 with commit 1284cd3a2b740d0118458d2ea470a1e5bc19b187 and fixed in 6.18.19 with commit 6ac890f1d60ac3707ee8dae15a67d9a833e49956 Issue introduced in 2.6.24 with commit 1284cd3a2b740d0118458d2ea470a1e5bc19b187 and fixed in 6.19.9 with commit 95597d11dc8bddb2b9a051c9232000bfbb5e43ba Issue introduced in 2.6.24 with commit 1284cd3a2b740d0118458d2ea470a1e5bc19b187 and fixed in 7.0 with commit 950803f7254721c1c15858fbbfae3deaaeeecb11 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-43456 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/bonding/bond_main.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/9baf26a91565b7bb2b1d9f99aaf884a2b28c2f6d https://git.kernel.org/stable/c/6ac890f1d60ac3707ee8dae15a67d9a833e49956 https://git.kernel.org/stable/c/95597d11dc8bddb2b9a051c9232000bfbb5e43ba https://git.kernel.org/stable/c/950803f7254721c1c15858fbbfae3deaaeeecb11