In the Linux kernel, the following vulnerability has been resolved:

bonding: provide a net pointer to __skb_flow_dissect()

After 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect")
we have to provide a net pointer to __skb_flow_dissect(),
either via skb->dev, skb->sk, or a user provided pointer.

In the following case, syzbot was able to cook a bare skb.

WARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect+0xb57/0x68b0 net/core/flow_dissector.c:1131, CPU#1: syz.2.1418/11053
Call Trace:
<TASK>
bond_flow_dissect drivers/net/bonding/bond_main.c:4093 [inline]
__bond_xmit_hash+0x2d7/0xba0 drivers/net/bonding/bond_main.c:4157
bond_xmit_hash_xdp drivers/net/bonding/bond_main.c:4208 [inline]
bond_xdp_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5139 [inline]
bond_xdp_get_xmit_slave+0x1fd/0x710 drivers/net/bonding/bond_main.c:5515
xdp_master_redirect+0x13f/0x2c0 net/core/filter.c:4388
bpf_prog_run_xdp include/net/xdp.h:700 [inline]
bpf_test_run+0x6b2/0x7d0 net/bpf/test_run.c:421
bpf_prog_test_run_xdp+0x795/0x10e0 net/bpf/test_run.c:1390
bpf_prog_test_run+0x2c7/0x340 kernel/bpf/syscall.c:4703
__sys_bpf+0x562/0x860 kernel/bpf/syscall.c:6182
__do_sys_bpf kernel/bpf/syscall.c:6274 [inline]
__se_sys_bpf kernel/bpf/syscall.c:6272 [inline]
__x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:6272
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
58deb77cc52da9360d20676e68dd215742cbe473 affected < 8e53780732ee881394406f79da5263b81eb48f7e
58deb77cc52da9360d20676e68dd215742cbe473 affected < 3be945abdd228fd00f6afcf8d137002867a4651b
58deb77cc52da9360d20676e68dd215742cbe473 affected < f4faaa1297ecf3255a8591fff2633df05bd5ec84
58deb77cc52da9360d20676e68dd215742cbe473 affected < 0efee0b992f28bd5ee01c7a86ef6a307c42eb907
58deb77cc52da9360d20676e68dd215742cbe473 affected < bc3c8d2493c6f4d2038844dc8b7ee93de050f7fa
58deb77cc52da9360d20676e68dd215742cbe473 affected < de97735a40a144974bf3896ee4cc0270db2e47db
58deb77cc52da9360d20676e68dd215742cbe473 affected < 5f9b329096596b7e53e07d041d7fca4cbe1be752
Linux Linux affected
Version Status Constraints
5.5 affected —
0 unaffected < 5.5
5.10.249 unaffected ≤ 5.10.*
5.15.199 unaffected ≤ 5.15.*
6.1.162 unaffected ≤ 6.1.*
6.6.122 unaffected ≤ 6.6.*
6.12.68 unaffected ≤ 6.12.*
6.18.8 unaffected ≤ 6.18.*
6.19 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0efee0b992f28bd5ee01c7a86ef6a307c42eb907 cve-icon cve-icon
https://git.kernel.org/stable/c/3be945abdd228fd00f6afcf8d137002867a4651b cve-icon cve-icon
https://git.kernel.org/stable/c/5f9b329096596b7e53e07d041d7fca4cbe1be752 cve-icon cve-icon
https://git.kernel.org/stable/c/8e53780732ee881394406f79da5263b81eb48f7e cve-icon cve-icon
https://git.kernel.org/stable/c/bc3c8d2493c6f4d2038844dc8b7ee93de050f7fa cve-icon cve-icon
https://git.kernel.org/stable/c/de97735a40a144974bf3896ee4cc0270db2e47db cve-icon cve-icon
https://git.kernel.org/stable/c/f4faaa1297ecf3255a8591fff2633df05bd5ec84 cve-icon cve-icon
History

Sat, 14 Feb 2026 15:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: bonding: provide a net pointer to __skb_flow_dissect() After 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect") we have to provide a net pointer to __skb_flow_dissect(), either via skb->dev, skb->sk, or a user provided pointer. In the following case, syzbot was able to cook a bare skb. WARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect+0xb57/0x68b0 net/core/flow_dissector.c:1131, CPU#1: syz.2.1418/11053 Call Trace: <TASK> bond_flow_dissect drivers/net/bonding/bond_main.c:4093 [inline] __bond_xmit_hash+0x2d7/0xba0 drivers/net/bonding/bond_main.c:4157 bond_xmit_hash_xdp drivers/net/bonding/bond_main.c:4208 [inline] bond_xdp_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5139 [inline] bond_xdp_get_xmit_slave+0x1fd/0x710 drivers/net/bonding/bond_main.c:5515 xdp_master_redirect+0x13f/0x2c0 net/core/filter.c:4388 bpf_prog_run_xdp include/net/xdp.h:700 [inline] bpf_test_run+0x6b2/0x7d0 net/bpf/test_run.c:421 bpf_prog_test_run_xdp+0x795/0x10e0 net/bpf/test_run.c:1390 bpf_prog_test_run+0x2c7/0x340 kernel/bpf/syscall.c:4703 __sys_bpf+0x562/0x860 kernel/bpf/syscall.c:6182 __do_sys_bpf kernel/bpf/syscall.c:6274 [inline] __se_sys_bpf kernel/bpf/syscall.c:6272 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:6272 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94
Title bonding: provide a net pointer to __skb_flow_dissect()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-02-14T15:09:50.517Z

Reserved: 2026-01-13T15:37:45.969Z

Link: CVE-2026-23119

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-02-14T15:16:07.043

Modified: 2026-02-14T15:16:07.043

Link: CVE-2026-23119

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.