A use‑after‑free bug in the Linux bonding driver causes the kernel to dereference freed memory when an enslave operation fails after a new slave has been added to the array. The flaw can be triggered by installing an XDP program and continuously assigning a dummy interface to the bond, leading to a kernel panic. If an attacker gains execution privilege, this defect could be leveraged to run arbitrary code in kernel mode, effectively allowing privilege escalation.

The vulnerability affects all Linux kernels that include the bonding driver, specifically Linux kernel 6.19 releases from rc1 through rc7. Every distribution that ships these kernels is potentially impacted. No other product or vendor is mentioned.

The CVSS score of 7.8 classifies this as a high–severity flaw. The EPSS score is reported as less than 1%, indicating a low probability of widespread exploitation at this time, and the issue is not listed in CISA’s KEV catalog. Exploitation would require the ability to load XDP programs and manipulate bonding interfaces, typically implying local or system‑level access on the affected host. The impact is a kernel crash with the possibility of privilege escalation, making this a serious risk for any environment running the affected kernel releases.