SECUFOCUSNOW
Home›CVE index›CVE-2026-52975
Review reviewHigh

CVE-2026-52975

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: bonding: 3ad: implement proper RCU rules for port->aggregator syzbot found a data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler [1] which hints at lack of proper RCU implementation. Add __rcu qualifier to port->aggregator, and add proper RCU API. [1] BUG: KCSAN: data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler write to 0xffff88813cf5c4b0 of 8 bytes by task 36 on cpu 0: ad_port_selection_logic drivers/net/bonding/bond_3ad.c:1659 [inline] bond_3ad_state_machine_handler+0x9d5/0...

CVSS
7.8
EPSS
0.14%
3.69% percentile
CISA KEV
Not listed
Published
2026.06.25
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.14%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: bonding: 3ad: implement proper RCU rules for port->aggregator syzbot found a data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler [1] which hints at lack of proper RCU implementation. Add __rcu qualifier to port->aggregator, and add proper RCU API. [1] BUG: KCSAN: data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler write to 0xffff88813cf5c4b0 of 8 bytes by task 36 on cpu 0: ad_port_selection_logic drivers/net/bonding/bond_3ad.c:1659 [inline] bond_3ad_state_machine_handler+0x9d5/0...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 < ba2272be04f0cb1e74e1e355ff32ef95df280731, >= 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 < 3b7265b3a82f40d2357c4004b26eb794a095b186, >= 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 < 5fb9ea4e8ebf514d92df2b6c9d0db25ba02ac735, >= 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 < c169c5837525ad842df6a542facf52b6f866a519, >= 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 < 78f409fd34fe9de2b24ad8e9dca1b4608a48ed3d, >= 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 < c4f050ce06c56cfb5993268af4a5cb66ed1cd04e, >= 3.13, >= 3.13 < 6.1.175, >= 6.2 < 6.6.141, >= 6.7 < 6.12.95, >= 6.13 < 6.18.33, >= 6.19 < 7.0.10, 7.1
Fixed versions
6.1.175, 6.6.141, 6.12.95, 6.18.33, 7.0.10

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available