CVE-2026-98074 bonding: do not clear curr_active_slave prematurely when releasing all slaves
A logic error in Linux kernel bonding driver leaks promiscuous mode on network devices during bond teardown, potentially causing resource exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98074?
CVE-2026-98074 is a denial of service vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bonding: do not clear curr_active_slave prematurely when releasing all slaves
When releasing all slaves during bond destruction (all == true), __bond_release_one() unconditionally clears bond->curr_active_slave to NULL in every iteration.
If a backup slave is released before the active slave, bond_alb_deinit_slave() triggers rlb_teach_disabled_mac_on_primary(), which increments the active slave dev promiscuity counter and sets bond_info->primary_is_promisc = 1.
Because bond->curr_active_slave was prematurely cleared to NULL when releasing the backup slave, the subsequent iteration releasing the active slave evaluates oldcurrent as NULL, so bond_change_active_slave(bond, NULL) is skipped. Consequently, bond_alb_handle_active_change() is never called to decrement the promiscuity counter, permanently leaking promiscuous mode on the physical device after bond teardown.
When oldcurrent == slave, bond_change_active_slave(bond, NULL) already sets bond->curr_active_slave to NULL. We only need to avoid selecting a new active slave when all == true. Replace the if (all) branch with if (!all && oldcurrent == slave).
Which versions are affected by CVE-2026-98074?
How do I fix CVE-2026-98074?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98074 being exploited?
There is no known exploitation of CVE-2026-98074 in the wild and no public exploit code.
Sources
Also known as AZL-104778, BELL-CVE-2026-98074, DEBIAN-CVE-2026-98074, GHSA-vrv6-53xj-7g2r, UBUNTU-CVE-2026-98074.