{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98074 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98074 is a denial of service vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98074 and fix it if it is affected.\n\nWhat it is: CVE-2026-98074 is a denial of service vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98074 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98074/ (Markdown: https://insights.sbomify.com/CVE-2026-98074/index.md)","id":"CVE-2026-98074","markdown":"https://insights.sbomify.com/CVE-2026-98074/index.md","name":"CVE-2026-98074","record":{"aliases":["AZL-104778","BELL-CVE-2026-98074","DEBIAN-CVE-2026-98074","GHSA-vrv6-53xj-7g2r","UBUNTU-CVE-2026-98074"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel bonding","requires_auth":"none","summary":"A logic error in Linux kernel bonding driver leaks promiscuous mode on network devices during bond teardown, potentially causing resource exhaustion.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: do not clear curr_active_slave prematurely when releasing all slaves\n\nWhen releasing all slaves during bond destruction (all == true),\n__bond_release_one() unconditionally clears bond-\u003ecurr_active_slave to\nNULL in every iteration.\n\nIf a backup slave is released before the active slave,\nbond_alb_deinit_slave() triggers rlb_teach_disabled_mac_on_primary(),\nwhich increments the active slave dev promiscuity counter and sets\nbond_info-\u003eprimary_is_promisc = 1.\n\nBecause bond-\u003ecurr_active_slave was prematurely cleared to NULL when\nreleasing the backup slave, the subsequent iteration releasing the active\nslave evaluates oldcurrent as NULL, so bond_change_active_slave(bond, NULL)\nis skipped. Consequently, bond_alb_handle_active_change() is never called\nto decrement the promiscuity counter, permanently leaking promiscuous\nmode on the physical device after bond teardown.\n\nWhen oldcurrent == slave, bond_change_active_slave(bond, NULL) already sets\nbond-\u003ecurr_active_slave to NULL. We only need to avoid selecting a new\nactive slave when all == true. Replace the if (all) branch with\nif (!all \u0026\u0026 oldcurrent == slave).","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"bonding: do not clear curr_active_slave prematurely when releasing all slaves","id":"CVE-2026-98074","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"bpf: reject BPF_PSEUDO_FUNC reference to the main program","id":"CVE-2026-98075"},"packages":[],"prev":{"headline":"net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().","id":"CVE-2026-98073"},"products":["Linux"],"published":"2026-09-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A logic error in Linux kernel bonding driver leaks promiscuous mode on network devices during bond teardown, potentially causing resource exhaustion.","url":"https://insights.sbomify.com/CVE-2026-98074/"}