Cloudanix VulnDB

CVE-2026-23310

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A local configuration change on certain Linux network setups can leave the system in an inconsistent state that triggers warnings or instability when those network interfaces are later removed.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

In the Linux kernel bonding driver, bond_option_xmit_hash_policy_set() lacks a guard equivalent to bond_xdp_check(), allowing a local user to switch xmit_hash_policy to vlan+srcmac on 802.3ad or balance-xor bonds while an XDP program remains attached; subsequent bond destruction then fails bond_xdp_set() with -EOPNOTSUPP and triggers WARN_ON in dev_xdp_uninstall().

Why it matters to the business

Organizations running Linux kernels with bonding interfaces and XDP programs may experience unexpected warnings or availability impact during interface teardown, increasing operational risk for high-availability or performance-critical network workloads until patches are applied.

How an attack unfolds

An attacker with local privileges first attaches a native XDP program to a compatible bonding interface, then uses bond option APIs to change xmit_hash_policy to the incompatible vlan+srcmac value; when the bond is later destroyed, the kernel hits the unguarded check path and emits a warning.

How to fix it

Upgrade to a Linux kernel containing commit 39a0876d595b or the follow-on fix that adds the missing guard in bond_option_xmit_hash_policy_set(); avoid vlan+srcmac policy on XDP-loaded 802.3ad/balance-xor bonds until patched.

How to confirm the fix worked

After upgrade, confirm bond_xdp_check() is invoked from bond_option_xmit_hash_policy_set(); attempt the previously allowed policy change while XDP is loaded and verify it is now rejected with -EOPNOTSUPP.

Typical attack path

  1. Obtain local access with privileges to manage network bonds and load XDP programs
  2. Attach XDP program to bond in 802.3ad or balance-xor mode using a compatible policy
  3. Change xmit_hash_policy to vlan+srcmac via netlink or sysfs
  4. Trigger bond destruction to invoke dev_xdp_uninstall()
  5. Observe WARN_ON and potential system impact

How to detect it

Review kernel logs for WARN_ON messages originating from dev_xdp_uninstall or bond_xdp_set during bond destruction; inspect audit logs for netlink calls altering bonding xmit_hash_policy on interfaces that also have XDP programs attached.

What your security team should do

  • Prioritize kernel updates for systems using bonding with XDP
  • Audit bonding configurations for xmit_hash_policy settings on XDP-enabled interfaces
  • Monitor for kernel warnings referencing dev_xdp_uninstall or bond_xdp_set during interface teardown
  • Restrict unprivileged local access to netlink bond configuration until mitigated

The record

In the Linux kernel, the following vulnerability has been resolved: bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded bond_option_mode_set() already rejects mode changes that would make a loaded XDP program incompatible via bond_xdp_check(). However, bond_option_xmit_hash_policy_set() has no such guard. For 802.3ad and balance-xor modes, bond_xdp_check() returns false when xmit_hash_policy is vlan+srcmac, because the 802.1q payload is usually absent due to hardware offload. This means a user can: 1. Attach a native XDP program to a bond in 802.3ad/balance-xor mode with a compatible xmit_hash_policy (e.g. layer2+3). 2. Change xmit_hash_policy to vlan+srcmac while XDP remains loaded. This leaves bond->xdp_prog set but bond_xdp_check() now returning false for the same device. When the bond is later destroyed, dev_xdp_uninstall() calls bond_xdp_set(dev, NULL, NULL) to remove the program, which hits the bond_xdp_check() guard and returns -EOPNOTSUPP, triggering: WARN_ON(dev_xdp_install(dev, mode, bpf_op, NULL, 0, NULL)) Fix this by rejecting xmit_hash_policy changes to vlan+srcmac when an XDP program is loaded on a bond in 802.3ad or balance-xor mode. commit 39a0876d595b ("net, bonding: Disallow vlan+srcmac with XDP") introduced bond_xdp_check() which returns false for 802.3ad/balance-xor modes when xmit_hash_policy is vlan+srcmac. The check was wired into bond_xdp_set() to reject XDP attachment with an incompatible policy, but the symmetric path -- preventing xmit_hash_policy from being changed to an incompatible value after XDP is already loaded -- was left unguarded in bond_option_xmit_hash_policy_set(). Note: commit 094ee6017ea0 ("bonding: check xdp prog when set bond mode") later added a similar guard to bond_option_mode_set(), but bond_option_xmit_hash_policy_set() remained unprotected.

Affected packages

Ecosystem Package Introduced Fixed