CVE-2026-23451
Description
A flaw was found in the Linux kernel's bonding component. When a specific network configuration involving a stack of two bonding devices is set up, the bond_header_parse() function can enter an infinite loop. This vulnerability can lead to a Denial of Service (DoS), making the affected system unresponsive.
Statement
A MODERATE denial-of-service flaw was found in the Linux kernel bonding driver. When two bonding devices are stacked (one bonding device configured on top of another), the bond_header_parse() function can enter an infinite loop, because skb->dev always points to the top of the device hierarchy, so the header-parse recursion never reaches the leaf device's parse method. This stalls packet processing and can make the affected system unresponsive or consume excessive CPU. Red Hat assessed this flaw as MODERATE (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) with a local attack vector, because exploitation requires a system already configured with the non-standard stacked bonding setup; this differs from the upstream CVEORG rating of 7.5 with a network attack vector. The vulnerable code is not present in the kernels shipped in supported Red Hat Enterprise Linux releases and Red Hat In-Vehicle OS, so those products are not affected. The only affected record is the kernel in Red Hat Enterprise Linux 6 Extended Life Cycle Support, which is out of support scope.
Mitigation
This flaw can only be triggered in a stacked bonding configuration, so avoiding configurations in which one bonding device is layered on top of another bonding device prevents the infinite loop in bond_header_parse(). No supported Red Hat Enterprise Linux or Red Hat In-Vehicle OS releases contain the vulnerable code, so no update is required for those products. For the out-of-support-scope Red Hat Enterprise Linux 6 ELS kernel, no fix is planned; upgrading to a supported Red Hat Enterprise Linux release is the available remediation.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.5 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
