In the Linux kernel, the following vulnerability has been resolved:

bonding: alb: fix uninitialized transport header access in alb_determine_nd()

alb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers.
However, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets
or forwarded packets), skb->transport_header is not guaranteed to be
initialized. While pskb_network_may_pull() ensures the packet data is
linear starting from the network header, it does not set or adjust the
transport header offset.

Dereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory.

Fetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(),
and reload ipv6hdr in case pskb_may_pull() reallocated skb->head.
Also remove the unused bond argument from alb_determine_nd().

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 affected < e39cf90bd856443542b97933289749fca07476bf
0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 affected < 27314f96d29b54e815e7a9b84c3273f1895e68e2
0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 affected < 3b178894931a268c09126a5b53630f343e10e296
0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 affected < 70f3995830d3f1e79faa14eb0605914f778feca9
Linux Linux affected
Version Status Constraints
5.18 affected —
0 unaffected < 5.18
6.12.111 unaffected ≤ 6.12.*
6.18.53 unaffected ≤ 6.18.*
7.2.7 unaffected ≤ 7.2.*
7.3-rc2 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/27314f96d29b54e815e7a9b84c3273f1895e68e2 cve-icon
https://git.kernel.org/stable/c/3b178894931a268c09126a5b53630f343e10e296 cve-icon
https://git.kernel.org/stable/c/70f3995830d3f1e79faa14eb0605914f778feca9 cve-icon
https://git.kernel.org/stable/c/e39cf90bd856443542b97933289749fca07476bf cve-icon
History

Fri, 25 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix uninitialized transport header access in alb_determine_nd() alb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers. However, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets or forwarded packets), skb->transport_header is not guaranteed to be initialized. While pskb_network_may_pull() ensures the packet data is linear starting from the network header, it does not set or adjust the transport header offset. Dereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory. Fetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(), and reload ipv6hdr in case pskb_may_pull() reallocated skb->head. Also remove the unused bond argument from alb_determine_nd().
Title bonding: alb: fix uninitialized transport header access in alb_determine_nd()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-25T10:24:22.877Z

Reserved: 2026-09-25T10:19:56.075Z

Link: CVE-2026-98089

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.