CVE-2026-74726

The vulnerability occurs in the Linux bonding driver when the bond_alb_monitor function evaluates the primary_is_promisc flag while RCU is held but before acquiring the RTNL lock. After the lock is obtained, the monitor continues to act on the stale value, even though the active bond slave may have been removed or switched. This race can result in a NULL pointer dereference or a counter underflow that pins a new slave in promiscuous mode. Those conditions trigger a kernel OOPS and a fatal exception, bringing the entire system down. The weakness is a race condition coupled with an unchecked pointer.

The problem is present in all Linux kernel builds that include the bonding driver without the recent patch. The affected component is the bonding module (drivers/net/bonding/bond_alb.c). No specific kernel version range is stated, so any unrepaired kernel that ships these code paths is vulnerable.

The CVSS score of 7.3 indicates a high severity of a local denial‑of‑service outcome. The EPSS score is below 1%, signaling a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to modify or delete bond members, which usually needs CAP_NET_ADMIN or root privileges; this requirement is inferred from the nature of bonding configuration changes. A local attacker with sufficient privileges could trigger the race by toggling a bond slave while the monitor is active, leading to a system crash.