CVE-2026-23099

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel bonding driver has a flaw where the BOND MODE 8023AD mode is not limited to Ethernet devices. This can lead to a global out-of-bounds read in the hw addr create function within net/core/dev addr lists.c, as reported by syzbot. The issue occurs when handling multicast addresses, specifically related to the lacpdu mcast addr variable. The syzbot report indicates a potential KASAN (Kernel Address Sanitizer) detection of this out-of-bounds read.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.