{"id":11290,"date":"2026-09-04T18:53:08","date_gmt":"2026-09-04T10:53:08","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74726"},"modified":"2026-09-04T18:53:08","modified_gmt":"2026-09-04T10:53:08","slug":"cve-2026-74726","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74726","title":{"rendered":"CVE-2026-74726 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: alb: re-chec"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor<\/p>\n<p>bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and<br \/>\ntakes RTNL via rtnl_trylock() before undoing the promiscuity it set on the<br \/>\nactive slave. In that window the active slave can change under RTNL<br \/>\n(RTM_DELLINK -&gt; __bond_release_one() -&gt; bond_alb_handle_active_change()),<br \/>\nwhich already drops the promiscuity and clears primary_is_promisc. The<br \/>\nmonitor still acts on the stale decision: if the slave was removed with no<br \/>\nfailover, curr_active_slave is now NULL and the deref faults; if it failed<br \/>\nover, the stale dev_set_promiscuity(-1) underflows the new slave&#8217;s<br \/>\npromiscuity counter and pins it in IFF_PROMISC.<\/p>\n<p>  Oops: general protection fault, probably for non-canonical address &#8230;<br \/>\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]<br \/>\n  Workqueue: b42 bond_alb_monitor<br \/>\n  RIP: 0010:bond_alb_monitor (drivers\/net\/bonding\/bond_alb.c:1600)<br \/>\n   process_one_work (kernel\/workqueue.c:3322)<br \/>\n   worker_thread (kernel\/workqueue.c:3486)<br \/>\n   kthread (kernel\/kthread.c:436)<br \/>\n   ret_from_fork (arch\/x86\/kernel\/process.c:158)<br \/>\n  Kernel panic &#8211; not syncing: Fatal exception<\/p>\n<p>Re-check primary_is_promisc (and curr_active_slave) after taking RTNL so<br \/>\nthe monitor only undoes an increment it still owns. The other bonding<br \/>\nmonitors already re-read state under RTNL in their commit phase<br \/>\n(bond_miimon_commit\/bond_ab_arp_commit); bond_alb_monitor() was the only<br \/>\none acting on the pre-trylock decision.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor<\/p>\n<p>bond_alb_monitor() reads primary_is_promisc under RCU, th<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11290","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11290","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11290"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11290"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11290"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}