Riskcovery

CVE-2026-98966

bonding: fix the program leak when XDP is replaced

State
Published
Severity
Not scored
Published
Oct 23, 2026
Updated
Oct 23, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

bonding: fix the program leak when XDP is replaced

We need to release the reference on the old BPF prog, whether we are going to no-prog, or replacing the prog with another.

Spotted by AI while running tests for the propagation series (leaked programs were accumulating). Selftest will come in the net-next series to avoid conflicts.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e to before bba6b1b086f9f4ddbfdaba7ea6279dc3abec70c7Affected
  • 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e to before 184b5ddf82d45d6f75cc83719a2e453392512bd2Affected
LinuxLinux
  • 5.15Affected
  • before 5.15Not affected
  • 7.2.11 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.