The vulnerability occurs during the shutdown of a Linux bonding interface. When all slave devices are released, the bonding code clears the active slave pointer too early. This causes the active slave’s promiscuous mode counter to never be decremented. As a result, the underlying physical interface remains in promiscuous mode even after the bond is torn down. Persistent promiscuous mode can allow the device to receive all network traffic, potentially exposing sensitive data to local attackers.

All Linux kernels that use the bonding driver are affected. The issue was identified in the kernel’s bonding module and applies to any deployment that creates bond interfaces and later removes them, regardless of the specific Linux distribution or kernel version. Vendors that ship the unpatched kernel must release a kernel update that removes the premature clear of the active slave pointer.

The bug does not provide an obvious exploit for remote code execution but increases the attack surface for local and network attackers who can capture traffic on a host that no longer sets its interface to promiscuous mode after bond removal. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score is 5.5, reflecting moderate severity. The likely attack vector is local or physical access to the host or exploitation of existing network privileges to reconfigure bonding interfaces.