Medium 5.5Published Feb 14, 2026

CVE-2026-23119bonding: provide a net pointer to __skb_flow_dissect()

Updated under an hour ago (Oct 27, 2026, 12:00 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: bonding: provide a net pointer to __skb_flow_dissect() After 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect") we have to provide a net pointer to __skb_flow_dissect(), either via skb->dev, skb->sk, or a user provided pointer. In the following case, syzbot was able to cook a bare skb. WARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect+0xb57/0x68b0 net/core/flow_dissector.c:1131, CPU#1: syz.2.1418/11053 Call Trace: <TASK> bond_flow_dissect drivers/net/bonding/bond_main.c:4093 [inline] __bond_xmit_hash+0x2d7/0xba0 drivers/net/bonding/bond_main.c:4157 bond_xmit_hash_xdp drivers/net/bonding/bond_main.c:4208 [inline] bond_xdp_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5139 [inline] bond_xdp_get_xmit_slave+0x1fd/0x710 drivers/net/bonding/bond_main.c:5515 xdp_master_redirect+0x13f/0x2c0 net/core/filter.c:4388 bpf_prog_run_xdp include/net/xdp.h:700 [inline] bpf_test_run+0x6b2/0x7d0 net/bpf/test_run.c:421 bpf_prog_test_run_xdp+0x795/0x10e0 net/bpf/test_run.c:1390 bpf_prog_test_run+0x2c7/0x340 kernel/bpf/syscall.c:4703 __sys_bpf+0x562/0x860 kernel/bpf/syscall.c:6182 __do_sys_bpf kernel/bpf/syscall.c:6274 [inline] __se_sys_bpf kernel/bpf/syscall.c:6272 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:6272 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-476
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	58deb77cc52da9360d20676e68dd215742cbe473 builds before 8e53780732ee881394406f79da5263b81eb48f7e; 58deb77cc52da9360d20676e68dd215742cbe473 builds before 3be945abdd228fd00f6afcf8d137002867a4651b; from 58deb77cc52da9360d20676e68dd215742cbe473 before f4faaa1297ecf3255a8591fff2633df05bd5ec84; 58deb77cc52da9360d20676e68dd215742cbe473 builds before 0efee0b992f28bd5ee01c7a86ef6a307c42eb907; from 58deb77cc52da9360d20676e68dd215742cbe473 before bc3c8d2493c6f4d2038844dc8b7ee93de050f7fa; from 58deb77cc52da9360d20676e68dd215742cbe473 before de97735a40a144974bf3896ee4cc0270db2e47db; 58deb77cc52da9360d20676e68dd215742cbe473 builds before 5f9b329096596b7e53e07d041d7fca4cbe1be752	CNA record
linux linux_kernel linux:linux_kernel	from 5.5 before 5.10.249; from 5.11 before 5.15.199; from 5.16 before 6.1.162; from 6.2 before 6.6.122; from 6.7 before 6.12.68; from 6.13 before 6.18.8; 6.19; 6.19; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/8e53780732ee881394406f79da5263b81eb48f7e	patch
https://git.kernel.org/stable/c/3be945abdd228fd00f6afcf8d137002867a4651b	patch
https://git.kernel.org/stable/c/f4faaa1297ecf3255a8591fff2633df05bd5ec84	patch
https://git.kernel.org/stable/c/0efee0b992f28bd5ee01c7a86ef6a307c42eb907	patch
https://git.kernel.org/stable/c/bc3c8d2493c6f4d2038844dc8b7ee93de050f7fa	patch
https://git.kernel.org/stable/c/de97735a40a144974bf3896ee4cc0270db2e47db	patch
https://git.kernel.org/stable/c/5f9b329096596b7e53e07d041d7fca4cbe1be752	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.