CVE-2026-43441

What it actually does

This is a Linux kernel denial-of-service flaw in the bonding driver. When a system is booted with IPv6 fully disabled using the kernel parameter `ipv6.disable=1`, the IPv6 neighbor discovery table is not initialized. If bonding ARP/NS validation is enabled, an IPv6 Neighbor Solicitation or Neighbor Advertisement packet received on a bonded slave interface can still be processed by bonding validation code, which calls IPv6 address-checking logic and dereferences the uninitialized neighbor discovery table. The result is a kernel NULL pointer dereference and system crash, causing loss of availability.

Why it matters to the business

An unauthenticated attacker who can send traffic to an affected bonded network interface may be able to crash the host, disrupting workloads, network services, storage access, virtualization platforms, or clustered applications that depend on that Linux system. The risk is highest for servers using bonded NICs for high availability or throughput while also booting with IPv6 disabled. This issue is not currently listed in CISA KEV, has low EPSS, and has no known public exploit maturity in the provided data, but the impact is operationally significant because successful exploitation can take a system offline.

How an attack unfolds

An attacker first identifies or reaches a Linux host that uses the bonding driver with one or more slave interfaces and has bonding ARP/NS validation enabled. The vulnerable condition requires the host to have IPv6 disabled at boot using `ipv6.disable=1`, which prevents initialization of IPv6 neighbor discovery internals. The attacker then sends IPv6 Neighbor Solicitation or Neighbor Advertisement traffic toward a bonded slave interface. Despite IPv6 being disabled, the bonding receive validation path can process the packet and call into IPv6 address-checking code. Because the neighbor discovery table was never initialized, the kernel dereferences a NULL pointer in `__ipv6_chk_addr_and_flags()`, leading to an Oops/panic or crash depending on kernel panic settings. The practical attacker outcome is denial of service rather than code execution or data compromise.

How to fix it

Upgrade to a vendor-supported Linux kernel that includes the bonding fix for this issue, specifically the change that checks `ipv6_mod_enabled()` before dispatching IPv6 packets to the bonding Neighbor Advertisement receive path. No exact fixed package versions were provided, so use the relevant distribution kernel advisory and install the latest fixed kernel for each affected platform. Reboot into the updated kernel after installation. As interim mitigations, avoid booting affected systems with `ipv6.disable=1` where feasible, disable bonding ARP/NS validation if it is not required, restrict untrusted Layer 2 access to bonded slave interfaces, and filter unexpected IPv6 Neighbor Solicitation/Advertisement traffic at network boundaries where technically possible. If IPv6 must be disabled, prefer a vendor-recommended configuration that does not leave kernel IPv6 internals uninitialized in a way that exposes this bonding path.

How to confirm the fix worked

Confirm remediation by verifying the running kernel version matches a vendor release containing the bonding fix, not only that the package is installed. Check `/proc/cmdline` for `ipv6.disable=1`, enumerate bonded interfaces under `/proc/net/bonding/` or `/sys/class/net/*/bonding/`, and review bonding settings such as `arp_validate` and `ns_ip6_target` to identify remaining exposure. After patching and rebooting, monitor `dmesg`, `journalctl -k`, or centralized kernel logs while exercising normal bond failover and validation behavior; there should be no kernel Oops involving `bond_validate_na`, `bond_rcv_validate`, `ipv6_chk_addr`, or `__ipv6_chk_addr_and_flags`. Where safe and authorized, perform controlled validation in a test environment by sending IPv6 NS/NA traffic to a similarly configured bonded interface and confirming the system remains stable.

Typical attack path

1. Find or gain network reachability to a Linux system using bonded network interfaces.
2. Ensure traffic can reach a physical slave interface participating in the bond, typically from the same Layer 2 segment or a path that can deliver IPv6 Neighbor Discovery frames.
3. Send IPv6 Neighbor Solicitation or Neighbor Advertisement packets toward the bonded interface.
4. Trigger the bonding ARP/NS validation receive path while the host was booted with `ipv6.disable=1`.
5. Cause the bonding driver to call IPv6 address-checking code with IPv6 neighbor discovery state uninitialized.
6. Crash the kernel through a NULL pointer dereference, causing denial of service.

How to detect it

Look for evidence of kernel crashes or Oops events in `dmesg`, `journalctl -k`, `/var/log/kern.log`, `/var/log/messages`, `/var/log/syslog`, crash dump directories, kdump/vmcore records, and centralized log platforms. Key artifacts are NULL pointer dereferences in the IPv6 address-checking path with bonding functions in the call trace, especially `__ipv6_chk_addr_and_flags`, `ipv6_chk_addr`, `bond_validate_na`, `bond_rcv_validate`, and `bond_handle_frame`. Correlate crash times with network telemetry showing IPv6 Neighbor Solicitation or Neighbor Advertisement traffic arriving on bonded slave interfaces. Also review host configuration evidence: `/proc/cmdline` containing `ipv6.disable=1`, active bonding interfaces under `/proc/net/bonding/`, and non-disabled bonding validation settings. Because exploitation causes a crash rather than a persistent implant, detection is primarily through kernel logs, crash dumps, unexpected reboot records, and packet captures or flow logs near the time of failure.

• BUG: kernel NULL pointer dereference, address: 00000000000005d8
• RIP: 0010:__ipv6_chk_addr_and_flags
• __ipv6_chk_addr_and_flags+0x69/0x170
• ipv6_chk_addr+0x1f/0x30
• bond_validate_na+0x12e/0x1d0 [bonding]
• bond_rcv_validate+0x1a0/0x450 [bonding]
• bond_handle_frame+0x5e/0x290 [bonding]
• __netif_receive_skb_core.constprop.0
• ipv6.disable=1
• /proc/net/bonding/
• /sys/class/net/bonding_masters
• /sys/class/net/*/bonding/arp_validate
• /sys/class/net/*/bonding/ns_ip6_target
• ICMPv6 Neighbor Solicitation
• ICMPv6 Neighbor Advertisement

What your security team should do

• Inventory Linux systems using bonded interfaces, especially servers, hypervisors, storage nodes, network appliances, and clustered systems.
• Prioritize systems that boot with `ipv6.disable=1` and have bonding ARP/NS validation enabled.
• Apply the vendor-fixed kernel and reboot into it; track completion by running kernel version rather than installed package state alone.
• If immediate patching is not possible, disable unnecessary bonding ARP/NS validation or remove the `ipv6.disable=1` boot parameter where operationally safe.
• Restrict untrusted access to the same Layer 2 networks as bonded slave interfaces and block unexpected IPv6 Neighbor Discovery traffic where feasible.
• Monitor kernel logs for Oops or panic traces containing bonding and IPv6 address-checking functions.
• Treat unexpected reboots or kernel crashes on bonded Linux hosts as potential exploitation until logs and network context rule it out.