Security readout for executives and security teams
Plain-English summary
A Linux networking flaw can cause affected systems to become unresponsive when two bonding devices are stacked. The failure is limited to availability; the supplied CVSS assessment indicates no confidentiality or integrity impact. Exposure depends on both kernel revision and this uncommon network configuration.
Executive priority
Prioritize promptly where nested bonding supports critical or externally reachable services because successful triggering may cause an availability outage. For systems without stacked bonding, validate configuration and kernel status before escalating emergency change activity. No active exploitation is established by the supplied evidence.
Technical view
bond_header_parse() can loop because skb->dev continues pointing to the top of a two-device bonding hierarchy. The fix passes an explicit net_device pointer into header_ops.parse(), bounding recursion and ensuring the leaf parser is reached. The supplied CVSS 3.1 score is 7.5, with network reachability and high availability impact.
Likely exposure
Highest exposure is on Linux hosts using a stack of two bonding devices and lacking the relevant stable-kernel fix. Systems without stacked bonding are unlikely to reach the described condition. The supplied version data does not clearly define complete affected ranges, so distribution-specific status requires confirmation.
Exploitation context
The bundle reports no CISA KEV listing and provides no evidence of active exploitation or a public exploit. The CVSS vector describes network reachability without privileges or user interaction, but the required bonding hierarchy materially limits practical exposure. Treat exploitability beyond the documented condition as unconfirmed.
Researcher notes
The defect is a recursion-bounding failure in the bonding header parsing path. Five stable-kernel commits are supplied, but the bundle does not clearly express introduction-to-fix ranges. Versions 6.18.19 and 6.19.9 appear in the affected data with a default unaffected status; verify their precise meaning against upstream or distribution records.
Mitigation direction
- Install a vendor kernel update containing the applicable referenced stable-kernel fix.
- Check Linux distribution guidance to confirm affected and corrected package versions.
- Avoid stacking two bonding devices where operationally safe until remediation is verified.
- Prioritize externally reachable or availability-critical hosts using the affected configuration.
Validation and detection
- Inventory kernel versions and identify hosts configured with nested bonding devices.
- Map installed kernels to distribution advisories or the referenced stable commits.
- Confirm updated kernels are active after reboot, not merely installed.
- Verify bonding configuration and service availability after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23451 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9532d0d0ad1d726c06f807e8f0f1ec93cbabb452CVE reference, Linux
- https://git.kernel.org/stable/c/946bb6cacf0ccada7bc80f1cfa07c1ed79511c1cCVE reference, Linux
- https://git.kernel.org/stable/c/4172a7901cf43fe1cc63ef7a2ef33735ff7b7d13CVE reference, Linux
- https://git.kernel.org/stable/c/9b49c854f14f5e2d493e562a1e28d2e57fe37371CVE reference, Linux
- https://git.kernel.org/stable/c/b7405dcf7385445e10821777143f18c3ce20fa04CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.