CVE-2026-68336

bonding: fix devconf_all NULL dereference when IPv6 is disabled

State: Published
Severity: Not scored
Published: Aug 10, 2026
Updated: Aug 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bonding: fix devconf_all NULL dereference when IPv6 is disabled

When booting with the 'ipv6.disable=1' parameter, the devconf_all is never initialized because inet6_init() exits before addrconf_init() is called which initializes it. bond_send_validate(), however, will still call bond_ns_send_all() even ipv6 is indeed disabled. It will lead to NULL derefence of net->ipv6.devconf_all in ip6_pol_route().

BUG: kernel NULL pointer dereference, address: 000000000000000c [...] Workqueue: bond0 bond_arp_monitor [bonding] RIP: 0010:ip6_pol_route+0x69/0x480 [...] Call Trace: <TASK> ? srso_return_thunk+0x5/0x5f ? __pfx_ip6_pol_route_output+0x10/0x10 fib6_rule_lookup+0xfe/0x260 ? wakeup_preempt+0x8a/0x90 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? sched_balance_rq+0x369/0x810 ip6_route_output_flags+0xd7/0x170 bond_ns_send_all+0xde/0x280 [bonding] bond_ab_arp_probe+0x296/0x320 [bonding] ? srso_return_thunk+0x5/0x5f bond_activebackup_arp_mon+0xb4/0x2c0 [bonding] process_one_work+0x196/0x370 worker_thread+0x1af/0x320 ? srso_return_thunk+0x5/0x5f ? __pfx_worker_thread+0x10/0x10 kthread+0xe3/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x199/0x260 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>

Fix this by adding ipv6_mod_enabled() condition check in the caller.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 to before 451c2d5422a309393aa8ae161fc1a527c2f19ab2Affected 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 to before 2a4bad24ac5296b262ad821aa5e08bb265e6b154Affected 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 to before 690ce66782778e8c4b1fdd79c0b0890a100e9522Affected 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 to before 992dce02bdabbd9883255ea9b36494e34a7821d7Affected 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 to before 738039ad21e20ca2c5bbde2f5a4f5ad5fb718038Affected 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 to before 1c975de3343cdef506f2eecc833cc1f14b0401c4Affected
LinuxLinux	5.18Affected before 5.18Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 to before 451c2d5422a309393aa8ae161fc1a527c2f19ab2Affected
4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 to before 2a4bad24ac5296b262ad821aa5e08bb265e6b154Affected
4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 to before 690ce66782778e8c4b1fdd79c0b0890a100e9522Affected
4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 to before 992dce02bdabbd9883255ea9b36494e34a7821d7Affected
4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 to before 738039ad21e20ca2c5bbde2f5a4f5ad5fb718038Affected
4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 to before 1c975de3343cdef506f2eecc833cc1f14b0401c4Affected

LinuxLinux

5.18Affected
before 5.18Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.