SECUFOCUSNOW
Home›CVE index›CVE-2026-31419
Review reviewHigh

CVE-2026-31419

Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support

In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concurrent slave enslave/release can mutate the slave list during RCU-protected iteration, changing which slave is "last" mid-loop. This causes the original skb to be double-consumed (double-freed). Replace the racy bond_is_last_slave() check with a simple index comparison (i + 1 == slaves_count) against the pre-snapshot slave count taken vi...

CVSS
7.8
EPSS
0.12%
2.56% percentile
CISA KEV
Not listed
Published
2026.04.13
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.12%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concurrent slave enslave/release can mutate the slave list during RCU-protected iteration, changing which slave is "last" mid-loop. This causes the original skb to be double-consumed (double-freed). Replace the racy bond_is_last_slave() check with a simple index comparison (i + 1 == slaves_count) against the pre-snapshot slave count taken vi...

Affected product and versions

Product
Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support
Affected versions
>= 4e5bd03ae34652cd932ab4c91c71c511793df75c < 2de5c8eea0a9db99dae7c36f4b541b74b41d3a04, >= 4e5bd03ae34652cd932ab4c91c71c511793df75c < a0f661918edc79d7a75e468128af8d41e2a1a83a, >= 4e5bd03ae34652cd932ab4c91c71c511793df75c < d4cc7e4c80b1634c7b1497574a2fdb18df6c026c, >= 4e5bd03ae34652cd932ab4c91c71c511793df75c < f5b94654a4a19891a8108d66ef166de6c028c6cd, >= 4e5bd03ae34652cd932ab4c91c71c511793df75c < 2884bf72fb8f03409e423397319205de48adca16, >= 20949c3816463e97c6f8fe84c0280c7e5ae83a8d, >= f1d206181f19b00b275b258fea1418718a2f4173, >= c1f1691ef84fa6d38fa5e5148eca073145e97ffa, >= 5.10.94 < 5.11, >= 5.15.17 < 5.16, >= 5.16.3 < 5.17, >= 5.17, >= 5.17 < 6.12.86, >= 6.13 < 6.18.22, >= 6.19 < 6.19.12, 7.0
Fixed versions
5.11, 5.16, 5.17, 6.12.86, 6.18.22, 6.19.12

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416