In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix uninitialized transport header access in alb_determine_nd() alb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers. However, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets or forwarded packets), skb->transport_header is not guaranteed to be initialized. While pskb_network_may_pull() ensures the packet data is linear starting from the network header, it does not set or adjust the transport header offset. Dereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory. Fetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(), and reload ipv6hdr in case pskb_may_pull() reallocated skb->head. Also remove the unused bond argument from alb_determine_nd().

zetlyn/cve-nvd vulnerability cve CVE-2026-98089 known 2026-09-25

https://nvd.nist.gov/vuln/detail/CVE-2026-98089

Properties

product

Linux

receipt

Source: NVD
Its words: Linux
Read by: field:cve.affected[].affectedData[].product
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-04 18:16 UTC
Original: open at the source

2026-09-29 17:49 UTC	Linux
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "drivers/net/bonding/bond_alb.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "862c8eb6947689c44fe11353755576a3672563a5",
                "status": "affected",
                "version": "0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549",
                "versionType": "git"
              },
              {
                "lessThan": "7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99",
                "status": "affected",
                "version": "0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549",
                "versionType": "git"
              },
              {
                "lessThan": "e39cf90bd856443542b97933289749fca07476bf",
                "status": "affected",
                "version": "0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549",
                "versionType": "git"
              },
              {
                "lessThan": "27314f96d29b54e815e7a9b84c3273f1895e68e2",
                "status": "affected",
                "version": "0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549",
                "versionType": "git"
              },
              {
                "lessThan": "3b178894931a268c09126a5b53630f343e10e296",
                "status": "affected",
                "version": "0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549",
                "versionType": "git"
              },
              {
                "lessThan": "70f3995830d3f1e79faa14eb0605914f778feca9",
                "status": "affected",
                "version": "0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "drivers/net/bonding/bond_alb.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.18"
              },
              {
                "lessThan": "5.18",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.189",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.158",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.111",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.53",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.*",
                "status": "unaffected",
                "version": "7.2.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.3-rc2",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: alb: fix uninitialized transport header access in alb_determine_nd()\n\nalb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers.\nHowever, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets\nor forwarded packets), skb->transport_header is not guaranteed to be\ninitialized. While pskb_network_may_pull() ensures the packet data is\nlinear starting from the network header, it does not set or adjust the\ntransport header offset.\n\nDereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory.\n\nFetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(),\nand reload ipv6hdr in case pskb_may_pull() reallocated skb->head.\nAlso remove the unused bond argument from alb_determine_nd()."
      }
    ],
    "id": "CVE-2026-98089",
    "lastModified": "2026-10-03T11:18:30.643",
    "metrics": {},
    "published": "2026-09-25T11:17:38.590",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/27314f96d29b54e815e7a9b84c3273f1895e68e2"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/3b178894931a268c09126a5b53630f343e10e296"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/70f3995830d3f1e79faa14eb0605914f778feca9"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/862c8eb6947689c44fe11353755576a3672563a5"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/e39cf90bd856443542b97933289749fca07476bf"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Undergoing Analysis"
  }
}

status

Undergoing Analysis

receipt

Source: NVD
Its words: Undergoing Analysis
Read by: field:cve.vulnStatus
Said since: 2026-10-03 12:09 UTC
Last answered: 2026-10-04 18:16 UTC
Original: open at the source

2026-10-03 12:09 UTC	Undergoing Analysis
2026-10-02 12:00 UTC	Awaiting Analysis
2026-09-29 09:45 UTC	Received

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "drivers/net/bonding/bond_alb.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "862c8eb6947689c44fe11353755576a3672563a5",
                "status": "affected",
                "version": "0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549",
                "versionType": "git"
              },
              {
                "lessThan": "7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99",
                "status": "affected",
                "version": "0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549",
                "versionType": "git"
              },
              {
                "lessThan": "e39cf90bd856443542b97933289749fca07476bf",
                "status": "affected",
                "version": "0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549",
                "versionType": "git"
              },
              {
                "lessThan": "27314f96d29b54e815e7a9b84c3273f1895e68e2",
                "status": "affected",
                "version": "0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549",
                "versionType": "git"
              },
              {
                "lessThan": "3b178894931a268c09126a5b53630f343e10e296",
                "status": "affected",
                "version": "0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549",
                "versionType": "git"
              },
              {
                "lessThan": "70f3995830d3f1e79faa14eb0605914f778feca9",
                "status": "affected",
                "version": "0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "drivers/net/bonding/bond_alb.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.18"
              },
              {
                "lessThan": "5.18",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.189",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.158",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.111",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.53",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.*",
                "status": "unaffected",
                "version": "7.2.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.3-rc2",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: alb: fix uninitialized transport header access in alb_determine_nd()\n\nalb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers.\nHowever, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets\nor forwarded packets), skb->transport_header is not guaranteed to be\ninitialized. While pskb_network_may_pull() ensures the packet data is\nlinear starting from the network header, it does not set or adjust the\ntransport header offset.\n\nDereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory.\n\nFetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(),\nand reload ipv6hdr in case pskb_may_pull() reallocated skb->head.\nAlso remove the unused bond argument from alb_determine_nd()."
      }
    ],
    "id": "CVE-2026-98089",
    "lastModified": "2026-10-03T11:18:30.643",
    "metrics": {},
    "published": "2026-09-25T11:17:38.590",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/27314f96d29b54e815e7a9b84c3273f1895e68e2"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/3b178894931a268c09126a5b53630f343e10e296"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/70f3995830d3f1e79faa14eb0605914f778feca9"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/862c8eb6947689c44fe11353755576a3672563a5"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/e39cf90bd856443542b97933289749fca07476bf"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Undergoing Analysis"
  }
}

vendor

Linux

receipt

Source: NVD
Its words: Linux
Read by: field:cve.affected[].affectedData[].vendor
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-04 18:16 UTC
Original: open at the source

2026-09-29 17:49 UTC	Linux
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "drivers/net/bonding/bond_alb.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "862c8eb6947689c44fe11353755576a3672563a5",
                "status": "affected",
                "version": "0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549",
                "versionType": "git"
              },
              {
                "lessThan": "7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99",
                "status": "affected",
                "version": "0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549",
                "versionType": "git"
              },
              {
                "lessThan": "e39cf90bd856443542b97933289749fca07476bf",
                "status": "affected",
                "version": "0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549",
                "versionType": "git"
              },
              {
                "lessThan": "27314f96d29b54e815e7a9b84c3273f1895e68e2",
                "status": "affected",
                "version": "0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549",
                "versionType": "git"
              },
              {
                "lessThan": "3b178894931a268c09126a5b53630f343e10e296",
                "status": "affected",
                "version": "0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549",
                "versionType": "git"
              },
              {
                "lessThan": "70f3995830d3f1e79faa14eb0605914f778feca9",
                "status": "affected",
                "version": "0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "drivers/net/bonding/bond_alb.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.18"
              },
              {
                "lessThan": "5.18",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.189",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.158",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.111",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.53",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.*",
                "status": "unaffected",
                "version": "7.2.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.3-rc2",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: alb: fix uninitialized transport header access in alb_determine_nd()\n\nalb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers.\nHowever, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets\nor forwarded packets), skb->transport_header is not guaranteed to be\ninitialized. While pskb_network_may_pull() ensures the packet data is\nlinear starting from the network header, it does not set or adjust the\ntransport header offset.\n\nDereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory.\n\nFetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(),\nand reload ipv6hdr in case pskb_may_pull() reallocated skb->head.\nAlso remove the unused bond argument from alb_determine_nd()."
      }
    ],
    "id": "CVE-2026-98089",
    "lastModified": "2026-10-03T11:18:30.643",
    "metrics": {},
    "published": "2026-09-25T11:17:38.590",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/27314f96d29b54e815e7a9b84c3273f1895e68e2"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/3b178894931a268c09126a5b53630f343e10e296"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/70f3995830d3f1e79faa14eb0605914f778feca9"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/862c8eb6947689c44fe11353755576a3672563a5"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/e39cf90bd856443542b97933289749fca07476bf"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Undergoing Analysis"
  }
}

Text

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix uninitialized transport header access in alb_determine_nd() alb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers. However, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets or forwarded packets), skb->transport_header is not guaranteed to be initialized. While pskb_network_may_pull() ensures the packet data is linear starting from the network header, it does not set or adjust the transport header offset. Dereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory. Fetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(), and reload ipv6hdr in case pskb_may_pull() reallocated skb->head. Also remove the unused bond argument from alb_determine_nd().