CVE-2026-98074

A low impact flaw was found in the Linux kernel's network bonding driver, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases that ship Red Hat Enterprise Linux CoreOS; the corresponding Red Hat Enterprise Linux 6 Extended Lifecycle Support component is out of support scope. When a bonding interface is destroyed, __bond_release_one() unconditionally clears the current active slave pointer while releasing all slaves. If a backup slave is released before the active slave, the bonding driver's ALB handling increments the active physical device's promiscuity counter, and the subsequent release of the active slave skips the code path that would decrement it, permanently leaving the underlying physical network adapter in promiscuous mode after bond teardown. A local user with network administration privileges (CAP_NET_ADMIN) can trigger this issue by tearing down a bonding interface; an adapter left in promiscuous mode receives all traffic on the local network segment rather than only traffic intended for it. The flaw does not disrupt network device operation, crash the kernel, or allow modification of network traffic. Although the CVSS:3.1 base score is moderate (5.5), Red Hat rates the overall impact of this flaw as low, because exploitation requires local network administration privileges and observing the leaked traffic in practice additionally requires local packet-capture privileges. Due to the low impact and limited exposure, the fix for the affected Red Hat products is currently deferred; the residual risk is that a privileged local user could leave a physical interface in promiscuous mode after a bond is destroyed, weakening traffic isolation on the local network segment until the deferred fix is delivered.