LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23212: bonding: annotate data-races around slave->last_rx

In the Linux kernel, the following vulnerability has been resolved: bonding: annotate data-races around slave->last_rx slave->last_rx and slave->target_last_arp_rx[...] can be read and written locklessly. Add READ_ONCE() and WRITE_ONCE() annotations. syzbot reported: BUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1: bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335 bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533 __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039 __netif_receive_skb_one_core net/core/dev.c:6150 [inline] __netif_receive_skb+0x59/0x270 net/core/dev.c:6265 netif_receive_skb_internal net/core/dev.c:6351 [inline] netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410 ... write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 0: bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335 bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533 __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039 __netif_receive_skb_one_core net/core/dev.c:6150 [inline] __netif_receive_skb+0x59/0x270 net/core/dev.c:6265 netif_receive_skb_internal net/core/dev.c:6351 [inline] netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410 br_netif_receive_skb net/bridge/br_input.c:30 [inline] NF_HOOK include/linux/netfilter.h:318 [inline] ... value changed: 0x0000000100005365 -> 0x0000000100005366

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2026-23212 is a Linux kernel bonding driver data-race fix. The public record shows concurrent updates to receive-tracking fields, detected by syzbot/KCSAN. No CVSS, CWE, security impact, or active exploitation evidence is provided, so business urgency depends on whether affected systems use Linux network bonding.

Executive priority

Treat this as a patch-management item, not an emergency, unless critical infrastructure depends heavily on Linux bonding and vendor guidance raises severity. The missing CVSS and impact details make risk uncertain rather than clearly high.

Technical view

The issue is in drivers/net/bonding/bond_main.c around bond_rcv_validate. slave->last_rx and slave->target_last_arp_rx can be read and written without locking. Stable fixes add READ_ONCE() and WRITE_ONCE() annotations to make those lockless accesses explicit and safer under kernel concurrency rules.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel builds with the bonding driver configured or available. The CVE record lists Linux kernel version ranges and stable commit references, but distribution backports may change package-level exposure.

Exploitation context

The source bundle cites a syzbot KCSAN data-race report, not real-world exploitation. The CVE is not marked KEV, and no public source in the bundle describes exploitability, impact, or weaponized use.

Researcher notes

Evidence is limited to the kernel concurrency report and fix references. The record does not state confidentiality, integrity, availability, privilege, or remote attack impact. Further analysis should focus on whether the race can cause observable bonding failure, crash, or incorrect link-health decisions.

Mitigation direction

  • Map deployed kernels to vendor advisories for CVE-2026-23212.
  • Apply distribution kernel updates that include the referenced stable fixes.
  • Prioritize hosts using Linux bonding for production network paths.
  • Check whether vendor kernels have backported the bonding fix.
  • Monitor kernel and distribution advisories for impact clarification.

Validation and detection

  • Inventory Linux kernel versions across servers and network appliances.
  • Identify systems with bonding interfaces or the bonding module enabled.
  • Compare kernel source or package changelogs against referenced stable commits.
  • Review vendor CVE status because package versions may include backports.
  • Track regression testing for bonded network connectivity after updates.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23212 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf5b2b966f032f22d3a289045a5afd4afa09f09c6, f5b2b966f032f22d3a289045a5afd4afa09f09c6, f5b2b966f032f22d3a289045a5afd4afa09f09c6, f5b2b966f032f22d3a289045a5afd4afa09f09c6, f5b2b966f032f22d3a289045a5afd4afa09f09c6unaffected
LinuxLinux2.6.19, 0, 6.1.162, 6.6.123, 6.12.69, 6.18.9, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.