In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix...
zetlyn/cve-ghsa vulnerability ghsa GHSA-3x47-v429-xjvw cve CVE-2026-98089 known 2026-09-25
https://github.com/advisories/GHSA-3x47-v429-xjvw
Properties
| severity | unknownreceipt
This source has not kept a receipt for this claim yet. The next update that reads it will. |
|---|
Text
In the Linux kernel, the following vulnerability has been resolved:
bonding: alb: fix...
In the Linux kernel, the following vulnerability has been resolved:
bonding: alb: fix uninitialized transport header access in alb_determine_nd()
alb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers.
However, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets
or forwarded packets), skb->transport_header is not guaranteed to be
initialized. While pskb_network_may_pull() ensures the packet data is
linear starting from the network header, it does not set or adjust the
transport header offset.
Dereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory.
Fetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(),
and reload ipv6hdr in case pskb_may_pull() reallocated skb->head.
Also remove the unused bond argument from alb_determine_nd().