High Memory corruption

CVE-2026-31419 — net: bonding: fix use-after-free in bond_xmit_broadcast()

In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concurrent slave enslave/release can mutate the slave list during RCU-protected iteration, changing which slave is "last" mid-loop. This causes the original skb to be double-consumed (double-freed). Replace the racy bond_is_last_slave() check with a simple index comparison (i + 1 == slaves_count) against the pre-snapshot slave count taken via READ_ONCE() before the loop. This preserves the zero-copy optimization for the last slave while making the "last" determination stable against concurrent list mutations. The UAF can trigger the following crash: ================================================================== BUG: KASAN: slab-use-after-free in skb_clone Read of size 8 at addr ffff888100ef8d40 by task exploit/147 CPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:597) skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334) bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593) dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887) __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838) ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136) ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219) ip6_output (net/ipv6/ip6_output.c:250) ip6_send_skb (net/ipv6/ip6_output.c:1985) udp_v6_send_skb (net/ipv6/udp.c:1442) udpv6_sendmsg (net/ipv6/udp.c:1733) __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Allocated by task 147: Freed by task 147: The buggy address belongs to the object at ffff888100ef8c80 which belongs to the cache skbuff_head_cache of size 224 The buggy address is located 192 bytes inside of freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60) Memory state around the buggy address: ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================

Published Apr 13, 2026 · Updated Oct 13, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP · CNA: Linux

Low

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.

How the score was calculated

EPSS 0.2% (30-day exploitation probability)+1
Technical severity (high)+6

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation

Not confirmed

Not in CISA KEV — an absence of record, not proof it is unexploited.

EPSS FIRST

0.18%

ahead of 7% of scored CVEs · Oct 14, 2026

Affects

Linux

Linux and 1 more

CVSS base

7.8

High · 3 source(s)

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

Identify exposed assets running the affected vendor/product/version combinations (Linux Linux, Linux Linux Kernel).
Apply the fixed version or the patch documented under Remediation.
Search available logs for exploit probes matching the vulnerability class (memory corruption), errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

Vendor	Product	Versions	Status	Source
Linux	Linux	≥ 4e5bd03ae34652cd932ab4c91c71c511793df75c and < 00752893f96b344f258c9c6de18b33171ac4872cversion 5.17≥ 5.16.3 and < 5.17≥ 5.15.17 and < 5.16≥ 5.10.94 and < 5.11version c1f1691ef84fa6d38fa5e5148eca073145e97ffaversion f1d206181f19b00b275b258fea1418718a2f4173version 20949c3816463e97c6f8fe84c0280c7e5ae83a8d and 5 more ≥ 4e5bd03ae34652cd932ab4c91c71c511793df75c and < 2884bf72fb8f03409e423397319205de48adca16≥ 4e5bd03ae34652cd932ab4c91c71c511793df75c and < f5b94654a4a19891a8108d66ef166de6c028c6cd≥ 4e5bd03ae34652cd932ab4c91c71c511793df75c and < d4cc7e4c80b1634c7b1497574a2fdb18df6c026c≥ 4e5bd03ae34652cd932ab4c91c71c511793df75c and < a0f661918edc79d7a75e468128af8d41e2a1a83a≥ 4e5bd03ae34652cd932ab4c91c71c511793df75c and < 2de5c8eea0a9db99dae7c36f4b541b74b41d3a04	Vulnerable	CVE Program (cve.org) e CISA ADP
Linux	Linux Kernel	≥ 5.10.94 and < 5.11version 7.0-rc6version 7.0-rc5version 7.0-rc4version 7.0-rc3version 7.0-rc2version 7.0-rc1≥ 6.19 and < 6.19.12 and 4 more ≥ 6.13 and < 6.18.22≥ 5.17 and < 6.12.86≥ 5.16.3 and < 5.17≥ 5.15.17 and < 5.16	Vulnerable	NIST National Vulnerability Database

Attack characteristics

The CVSS vector, decoded. It describes the attack, not your exposure to it.

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Every base score collected

Sources score independently and may disagree; each row says who scored it and under which version.

Score	Version	Severity	Expl.	Impact	Scored by
7.8	CVSS 3.1	High	1.8	5.9	416baaa9-dc9f-4396-8d5f-8c081fb06d67 via NIST National Vulnerability Database
7.8	CVSS 3.1	High	—	—	Linux via CVE Program (cve.org) e CISA ADP
7.0	CVSS 3.1	High	1.0	5.9	0b0ca135-0b70-47e7-9f44-1890c2a1c46c via NIST National Vulnerability Database

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (score shown at the top: 416baaa9-dc9f-4396-8d5f-8c081fb06d67)

Scoring entities (NIST, CNA, ADP) score independently; each score is shown with its origin. For prioritization we use 7.8 (416baaa9-dc9f-4396-8d5f-8c081fb06d67 via NIST National Vulnerability Database) as a conservative provisional reference — not a definitive official score.

Weakness MITRE

Weakness class according to MITRE’s CWE catalog.

CWE-416 · Use After Free

Other CVEs with this weakness →

EPSS over time FIRST

Oct 13, 2026 → Oct 14, 2026 · 2 reading(s) · max 0.18%

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

Local/physical vector: focus on endpoint telemetry (EDR) from affected hosts.
Correlate service crashes/restarts with inbound traffic; repeated crashes may indicate attempts.

endpoint telemetry (EDR)crash dumps

Timeline

What happened to this CVE, newest first.

2026
Affected products added · linux/linux
Oct 13, 2026 · CVE Program (cve.org) e CISA ADP
Record published
Oct 13, 2026
Fix documented
Oct 13, 2026 · NIST National Vulnerability Database
CVSS changed · 7.8
Oct 13, 2026 · NIST National Vulnerability Database
Source status changed · → Modified
Oct 13, 2026 · NIST National Vulnerability Database
Record created in this database
Oct 13, 2026 · NIST National Vulnerability Database
CVE published
Apr 13, 2026 · Linux

Source activity

Repeated readings are counted rather than listed.

1× Official description updated · Oct 13, 2026 – Oct 13, 2026

References

27 on the record

git.kernel.org/stable/c/f5b94654a4a19891a8108d66ef166de6c028c6cd
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/2884bf72fb8f03409e423397319205de48adca16
Patch, NIST National Vulnerability Database
git.kernel.org/stable/c/d4cc7e4c80b1634c7b1497574a2fdb18df6c026c
Patch, NIST National Vulnerability Database
access.redhat.com/errata/RHSA-2026:36534
NIST National Vulnerability Database
access.redhat.com/errata/RHSA-2026:27353
NIST National Vulnerability Database
git.kernel.org/stable/c/00752893f96b344f258c9c6de18b33171ac4872c
NIST National Vulnerability Database
access.redhat.com/errata/RHSA-2026:25191
NIST National Vulnerability Database
access.redhat.com/errata/RHSA-2026:21209
NIST National Vulnerability Database
git.kernel.org/stable/c/a0f661918edc79d7a75e468128af8d41e2a1a83a
NIST National Vulnerability Database
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31419.json
NIST National Vulnerability Database
access.redhat.com/errata/RHSA-2026:36531
NIST National Vulnerability Database
access.redhat.com/errata/RHSA-2026:19521
NIST National Vulnerability Database
bugzilla.redhat.com/show_bug.cgi
NIST National Vulnerability Database
access.redhat.com/security/cve/CVE-2026-31419
NIST National Vulnerability Database
access.redhat.com/errata/RHSA-2026:13566
NIST National Vulnerability Database
access.redhat.com/errata/RHSA-2026:22334
NIST National Vulnerability Database
access.redhat.com/errata/RHSA-2026:35870
NIST National Vulnerability Database
access.redhat.com/errata/RHSA-2026:22940
NIST National Vulnerability Database
access.redhat.com/errata/RHSA-2026:36533
NIST National Vulnerability Database
access.redhat.com/errata/RHSA-2026:22900
NIST National Vulnerability Database
git.kernel.org/stable/c/2de5c8eea0a9db99dae7c36f4b541b74b41d3a04
NIST National Vulnerability Database
access.redhat.com/errata/RHSA-2026:36172
NIST National Vulnerability Database
access.redhat.com/errata/RHSA-2026:23224
NIST National Vulnerability Database
access.redhat.com/errata/RHSA-2026:36532
NIST National Vulnerability Database
access.redhat.com/errata/RHSA-2026:27354
NIST National Vulnerability Database
access.redhat.com/errata/RHSA-2026:36530
NIST National Vulnerability Database
access.redhat.com/errata/RHSA-2026:25217
NIST National Vulnerability Database

Elsewhere on this site

Linux
every CVE for this vendor

Memory corruption
same class

CWE-416
other pages naming this weakness

Related CVEs (same products)

Critical CVE-2026-99999 ipv4: validate checksum_start before completing checksum 11h
Unknown CVE-2026-98432 ipv4: free inet_opt and ireq_opt after an RCU grace period 11h
Unknown CVE-2026-98424 wifi: cfg80211: undo netns switch if renaming the wiphy fails 1d
Unknown CVE-2026-98425 wifi: mac80211: don't warn when an IBSS has no channel to scan 1d
Unknown CVE-2026-98426 wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path 1d
Unknown CVE-2026-98427 net/sched: codel: bound the dropping loop per dequeue call 1d

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No CISA SSVC assessment.
No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2026-31419 is "net: bonding: fix use-after-free in bond_xmit_broadcast()", rated High. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. CVSS 7.8 describes technical severity. EPSS 0.18% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.