CVE-2026-98089
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
bonding: alb: fix uninitialized transport header access in alb_determine_nd()
alb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers. However, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets or forwarded packets), skb->transport_header is not guaranteed to be initialized. While pskb_network_may_pull() ensures the packet data is linear starting from the network header, it does not set or adjust the transport header offset.
Dereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory.
Fetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(), and reload ipv6hdr in case pskb_may_pull() reallocated skb->head. Also remove the unused bond argument from alb_determine_nd().
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel bonding driver contains a critical vulnerability within the adaptive load balancing algorithm, specifically in the alb_determine_nd function. This flaw arises from an improper handling of network packet headers when processing ICMPv6 traffic. The core issue is that the code attempts to access the transport layer header using icmp6_hdr(skb) without ensuring that the skb->transport_header field has been properly initialized or adjusted relative to the current data pointer. In standard networking stacks, this offset is typically set by lower-level protocol handlers during packet reception. However, in specific transmission paths such as those involving AF_PACKET raw sockets or forwarded packets, these initialization steps may be skipped or incomplete. Consequently, the function operates under an incorrect assumption about where the ICMPv6 header begins within the socket buffer structure.
This misalignment leads to a direct out-of-bounds memory access vulnerability. When alb_determine_nd dereferences icmp6_hdr(skb), it reads from a memory location that is not guaranteed to contain valid packet data. Depending on the state of the kernel heap and the specific contents of adjacent memory, this can result in reading sensitive information or causing undefined behavior within the kernel space. While pskb_network_may_pull ensures that the network header data is linearly accessible starting from skb->data, it does not automatically update the transport_header offset to reflect any potential reallocations or shifts in buffer layout. This gap between ensuring data availability and correctly tracking header offsets creates a exploitable condition where an attacker controlling packet input could trigger invalid memory reads with potentially severe consequences for system stability and security.
The operational impact of this vulnerability includes potential kernel panics due to illegal memory accesses, which can lead to denial of service conditions for systems relying on the bonding driver. Furthermore, if the out-of-bounds read retrieves sensitive data from adjacent kernel structures, it could facilitate information disclosure attacks. The flaw is particularly dangerous because it exists in a path that may be triggered by local users with access to raw sockets or through network forwarding mechanisms, expanding the attack surface beyond remote exploitation scenarios. This aligns with CWE-125 Out-of-bounds Read and CWE-457 Use of Uninitialized Variable, highlighting both the memory safety violation and the logical error in header tracking.
To mitigate this vulnerability, the kernel developers have implemented a fix that explicitly fetches the icmp6hdr pointer immediately after validating access to ipv6hdr using pskb_network_may_pull. This approach ensures that the transport header is calculated based on the actual network header position rather than relying on potentially stale or uninitialized offsets. Additionally, the code reloads the ipv6hdr structure in case pskb_may_pull reallocates the skb head, preventing pointer invalidation issues. The unused bond argument was also removed from alb_determine_nd to clean up the function signature and reduce complexity. Systems running affected versions of the Linux kernel should apply the latest security patches that include this bonding driver fix. Administrators can monitor for updates via their distribution's package management system or by applying upstream kernel commits addressing CVE details related to bonding ALB transport header handling. Regularly updating the kernel ensures protection against these memory safety violations and maintains compliance with secure coding standards outlined in ATT&CK techniques involving local privilege escalation through kernel exploitation vectors.