CVE-2026-23119

What it actually does

Missing net namespace pointer passed to __skb_flow_dissect in the bonding driver's XDP transmit path allows a bare skb to trigger a kernel warning and potential denial-of-service in flow_dissector.c when processing XDP redirects or BPF test runs.

Why it matters to the business

Systems using Linux bonding with XDP may experience crashes or network instability, reducing availability of network-dependent services; affected Ubuntu 20.04 LTS packages require prompt updates despite low exploit probability.

How an attack unfolds

An attacker with local access crafts an skb lacking device or socket context and exercises the bond_xdp_get_xmit_slave path via XDP redirect or bpf_prog_test_run_xdp, causing the flow dissector to hit the missing net pointer assertion.

How to fix it

Upgrade linux-aws-5.15 and linux-azure-5.15 packages on Ubuntu 20.04 LTS to version 5.15.0-1041.46~20.04.1 or 5.15.0-1045.52~20.04.1 respectively; apply kernel updates and reboot affected hosts.

How to confirm the fix worked

Verify installed package versions match the listed fixed releases; confirm absence of the warning string 'WARNING: net/core/flow_dissector.c:1131' after XDP operations on bonding devices; re-run BPF test suites.

Typical attack path

1. Obtain local access on an affected kernel
2. Attach or trigger XDP on a bonding interface
3. Invoke bond_xdp_get_xmit_slave through redirect or BPF test run
4. Supply skb without dev/sk/net pointer to reach __skb_flow_dissect
5. Trigger warning and potential crash in flow_dissector

How to detect it

Search kernel logs and dmesg for the warning at net/core/flow_dissector.c:1131 accompanied by call traces containing bond_flow_dissect, __bond_xmit_hash, bond_xdp_get_xmit_slave, or xdp_master_redirect; inspect BPF test run activity on bonding devices.

• WARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect
• bond_flow_dissect drivers/net/bonding/bond_main.c:4093
• __bond_xmit_hash+0x2d7/0xba0 drivers/net/bonding/bond_main.c:4157
• bond_xdp_get_xmit_slave+0x1fd/0x710 drivers/net/bonding/bond_main.c:5515

What your security team should do

• Patch all listed Ubuntu packages within standard change windows
• Prioritize systems exposing XDP or bonding interfaces
• Monitor kernel logs for flow_dissector warnings post-deployment
• Track upstream stable updates for additional affected kernels