CVE-2026-23119: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23119 is a null pointer dereference vulnerability in the Linux kernel's bonding driver that can cause a denial of service. The flaw exists in the bond_flow_dissect function, which fails to provide a required network namespace pointer to __skb_flow_dissect() during XDP (eXpress Data Path) packet processing. It was published on February 14, 2026, and affects Linux kernel versions 5.5 through 5.10.248, 5.11 through 5.15.198, 5.16 through 6.1.161, 6.2 through 6.6.121, 6.7 through 6.12.67, 6.13 through 6.18.7, and 6.19-rc1 through 6.19-rc6. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is a missing network namespace (net) pointer passed to __skb_flow_dissect() in the Linux bonding driver's __bond_xmit_hash function (CWE-476: NULL Pointer Dereference). After kernel commit 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect") mandated that callers supply a net pointer — either via skb->dev, skb->sk, or an explicit argument — the bonding code path triggered during XDP operations (bond_xdp_xmit_3ad_xor_slave_get → bond_xdp_get_xmit_slave → xdp_master_redirect) was not updated accordingly. A local attacker can craft a bare SKB without proper device or socket context and submit it via the BPF bpf_prog_test_run_xdp syscall interface, triggering a kernel WARN_ON at net/core/flow_dissector.c:1131 and potentially destabilizing the bonding subsystem (Feedly, Kernel Patch).

Successful exploitation results in a kernel warning and potential denial of service, crashing or destabilizing the bonding network driver on affected systems. There is no confidentiality or integrity impact — the vulnerability is limited to availability (HIGH) on the local system. Systems using bonded network interfaces in conjunction with XDP/BPF programs are most at risk, as the instability can disrupt network connectivity for all traffic traversing the bonded interface (Feedly, Red Hat CVE).

1. Gain local access: Obtain a low-privileged local account on a Linux system running an affected kernel version with bonded network interfaces configured.
2. Verify XDP/BPF capability: Confirm that the system allows loading BPF programs (check CAP_BPF or CAP_NET_ADMIN capabilities, or permissive unprivileged_bpf_disabled settings).
3. Craft a bare SKB: Write a BPF/XDP program that generates a socket buffer (SKB) without a valid skb->dev or skb->sk context — effectively a "bare" SKB lacking network namespace information.
4. Trigger via bpf_prog_test_run: Submit the crafted XDP program and packet via the bpf_prog_test_run_xdp BPF syscall interface, routing it through the bonding driver's bond_xdp_get_xmit_slave → __bond_xmit_hash → bond_flow_dissect call chain.
5. Trigger null dereference: The missing net pointer passed to __skb_flow_dissect() triggers a kernel WARN_ON at net/core/flow_dissector.c:1131, potentially causing a kernel panic or bonding driver instability and resulting in denial of service (Feedly).

• Logs: Kernel warning messages in dmesg or /var/log/kern.log containing WARNING: net/core/flow_dissector.c:1131 and stack traces referencing bond_flow_dissect, __bond_xmit_hash, bond_xdp_get_xmit_slave, or bpf_prog_test_run_xdp.
• Process: Unusual processes invoking the bpf syscall (syscall number 321 on x86_64) with BPF_PROG_TEST_RUN commands on systems with bonded interfaces.
• Network: Unexpected instability or drops on bonded network interfaces (bond0, bond1, etc.) coinciding with BPF program loading activity.
• System: Kernel oops or panic entries in crash dump files (/var/crash/) referencing the bonding driver or flow dissector code paths.

Patches are available across multiple stable kernel branches. Organizations should upgrade to at least the following fixed versions based on their kernel series: 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, or 6.18.8. Patch commits are available in the Linux kernel stable git repository. As a workaround where patching is not immediately possible, restrict the ability of unprivileged users to load BPF/XDP programs by setting kernel.unprivileged_bpf_disabled=1 via sysctl, and limit CAP_NET_ADMIN and CAP_BPF capabilities to trusted users only. Monitor kernel logs for flow dissector warnings as an early detection measure (Feedly, Kernel Patch).

Red Hat has acknowledged the vulnerability and published a CVE advisory page tracking its impact on RHEL products (Red Hat CVE). Ubuntu has issued multiple security notices addressing this CVE across various kernel flavors, including USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, and USN-8297-1 (Ubuntu USN-8180-1). Amazon Linux and Oracle Linux have also released kernel updates addressing this issue. No notable independent researcher commentary or significant social media discussion has been observed beyond routine vendor patch tracking.