CVE-2026-98089

bonding: alb: fix uninitialized transport header access in alb_determine_nd()

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bonding: alb: fix uninitialized transport header access in alb_determine_nd()

alb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers. However, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets or forwarded packets), skb->transport_header is not guaranteed to be initialized. While pskb_network_may_pull() ensures the packet data is linear starting from the network header, it does not set or adjust the transport header offset.

Dereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory.

Fetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(), and reload ipv6hdr in case pskb_may_pull() reallocated skb->head. Also remove the unused bond argument from alb_determine_nd().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 to before 862c8eb6947689c44fe11353755576a3672563a5Affected 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 to before 7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99Affected 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 to before e39cf90bd856443542b97933289749fca07476bfAffected 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 to before 27314f96d29b54e815e7a9b84c3273f1895e68e2Affected 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 to before 3b178894931a268c09126a5b53630f343e10e296Affected 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 to before 70f3995830d3f1e79faa14eb0605914f778feca9Affected
LinuxLinux	5.18Affected before 5.18Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 to before 862c8eb6947689c44fe11353755576a3672563a5Affected
0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 to before 7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99Affected
0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 to before e39cf90bd856443542b97933289749fca07476bfAffected
0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 to before 27314f96d29b54e815e7a9b84c3273f1895e68e2Affected
0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 to before 3b178894931a268c09126a5b53630f343e10e296Affected
0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 to before 70f3995830d3f1e79faa14eb0605914f778feca9Affected

LinuxLinux

5.18Affected
before 5.18Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.