CVE-2026-45970

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the bonding ALB RX path. During rapid bond up/down cycles, the rlb deinitialize() function frees the rx hashtbl while RX handlers are still active. This creates a race condition where the rlb arp recv() function can be accessed after recv probe is set to NULL, leading to a null pointer dereference when attempting to access a freed rx hashtbl entry.

Recommendations Set recv probe to NULL and call synchronize net() to ensure all concurrent RX processing is complete before rx hashtbl is freed in bond alb deinitialize().