Loading vulnerability…
Linux Kernel Bonding Driver Type Confusion in bond_setup_by_slave()
CVE-2026-43456 is a type-confusion vulnerability in the Linux kernel bonding driver. When a non-Ethernet device, such as a GRE tunnel, is enslaved to a bond, bond_setup_by_slave() directly copies the slave's header_ops to the bond device. Subsequent dev_hard_header() calls can invoke device-specific callbacks, including ipgre_header() and ip6gre_header(), with the bond device instead of the slave. These callbacks use netdev_priv() and consequently interpret struct bonding data as incompatible tunnel-specific private data. This can cause invalid memory accesses, memory corruption, and kernel crashes. Reported exploitation also demonstrates local privilege escalation through kernel information disclosure and manipulation of packet-buffer metadata.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash the kernel and disrupt the entire host. Exploit research also reports kernel-address disclosure, KASLR bypass, and controlled memory corruption leading to arbitrary kernel code execution and local root privileges. Such escalation compromises system confidentiality, integrity, and availability. Remote exploitation is not established.
If you can’t patch tonight, do this now.
If patching is delayed, disable or blacklist the bonding module where bonding is unnecessary. Disable unprivileged user namespaces to reduce opportunities for unprivileged users to obtain namespace-scoped network administration capabilities. Restrict CAP_NET_ADMIN and prevent untrusted users or workloads from creating or modifying bonds and tunnel interfaces. Disabling unprivileged user namespaces does not protect against attackers who already possess the required network administration capabilities.
Patch, then assume compromise.
Install the distribution-supported kernel update addressing CVE-2026-43456 and reboot into the updated kernel. The fix introduces bond_header_ops wrappers that delegate header operations to the active slave using the slave's own device, ensuring callbacks access the correct private-data structure. Applicable updates include Ubuntu USN-8919-1 and USN-8920-1, along with corresponding SUSE, Unity Linux, and Google COS kernel updates. Use release-specific vendor package guidance rather than assuming a universal fixed upstream version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
38 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.