The Linux kernel had a flaw in the bonding driver related to XDP (eXpress Data Path). When an XDP program was replaced or removed, a reference to the old BPF program was not released, causing the program object to accumulate in memory with each replacement. The accumulation leads to a memory leak that can degrade kernel performance, exhaust available memory, and potentially result in a denial-of-service condition.

All Linux kernel builds that include the bonding driver and XDP support and have not incorporated the recent patch. Specific version information is not provided, so the fix applies to kernels released before the commit that introduced the change.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 2.3, indicating a low severity. Because the flaw requires the ability to load or replace XDP programs—a privileged kernel operation—the likely attack vector is a local privileged user. Once exploited, an attacker could induce a memory-based denial-of-service by repeatedly swapping XDP programs and preventing their cleanup.