Not yet scoredPublished Sep 25, 2026

CVE-2026-98089bonding: alb: fix uninitialized transport header access in alb_determine_nd()

Updated under an hour ago (Oct 27, 2026, 12:40 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix uninitialized transport header access in alb_determine_nd() alb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers. However, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets or forwarded packets), skb->transport_header is not guaranteed to be initialized. While pskb_network_may_pull() ensures the packet data is linear starting from the network header, it does not set or adjust the transport header offset. Dereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory. Fetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(), and reload ipv6hdr in case pskb_may_pull() reallocated skb->head. Also remove the unused bond argument from alb_determine_nd().

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Undergoing Analysis
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 before 862c8eb6947689c44fe11353755576a3672563a5; from 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 before 7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99; from 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 before e39cf90bd856443542b97933289749fca07476bf; from 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 before 27314f96d29b54e815e7a9b84c3273f1895e68e2; from 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 before 3b178894931a268c09126a5b53630f343e10e296; from 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 before 70f3995830d3f1e79faa14eb0605914f778feca9	CNA record

References

References

https://git.kernel.org/stable/c/862c8eb6947689c44fe11353755576a3672563a5
https://git.kernel.org/stable/c/7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99
https://git.kernel.org/stable/c/e39cf90bd856443542b97933289749fca07476bf
https://git.kernel.org/stable/c/27314f96d29b54e815e7a9b84c3273f1895e68e2
https://git.kernel.org/stable/c/3b178894931a268c09126a5b53630f343e10e296
https://git.kernel.org/stable/c/70f3995830d3f1e79faa14eb0605914f778feca9

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.