CVE-2026-23310: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23310 is a denial-of-service vulnerability in the Linux kernel's BPF/bonding subsystem, caused by a missing validation guard in bond_option_xmit_hash_policy_set(). It allows a local user with bonding configuration privileges to change the xmit_hash_policy to vlan+srcmac while an XDP program is loaded on a bond operating in 802.3ad or balance-xor mode, creating an inconsistent kernel state that triggers a WARN_ON when the bond device is destroyed. Affected Linux kernel versions span 5.15 through 6.6.130, 6.7 through 6.12.77, 6.13 through 6.18.17, and 6.19 through 6.19.7, as well as 7.0-rc1 and 7.0-rc2. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-1288 (Improper Validation of Consistency within Input). While bond_option_mode_set() already guards against mode changes that would make a loaded XDP program incompatible via bond_xdp_check(), the symmetric path in bond_option_xmit_hash_policy_set() lacked an equivalent check. An attacker can first attach a native XDP program to a bond in 802.3ad or balance-xor mode with a compatible policy (e.g., layer2+3), then change xmit_hash_policy to vlan+srcmac while XDP remains loaded. This leaves bond->xdp_prog set while bond_xdp_check() now returns false for the device; when the bond is later destroyed, dev_xdp_uninstall() calls bond_xdp_set(dev, NULL, NULL), which hits the guard and returns -EOPNOTSUPP, triggering WARN_ON(dev_xdp_install(...)) (Red Hat Bugzilla).

Successful exploitation results in a kernel warning (WARN_ON) and failure to cleanly unload the XDP program when the bond interface is destroyed, causing a denial-of-service condition affecting network availability on the host. There is no confidentiality or integrity impact — the vulnerability is limited to availability. The scope is local to the affected system, with no evidence of lateral movement potential (Red Hat CVE).

1. Gain local access: Obtain a local account on the target Linux system with sufficient privileges to configure bonding network interfaces (e.g., CAP_NET_ADMIN).
2. Create a bond in 802.3ad or balance-xor mode: Use ip link add bond0 type bond and set the mode with ip link set bond0 type bond mode 802.3ad (or balance-xor).
3. Set a compatible xmit_hash_policy: Configure a compatible policy such as layer2+3 using ip link set bond0 type bond xmit_hash_policy layer2+3.
4. Attach a native XDP program: Load a native XDP BPF program onto the bond interface using tools such as ip link set dev bond0 xdp obj <program.o> sec xdp.
5. Change xmit_hash_policy to vlan+srcmac: While the XDP program remains loaded, change the policy with ip link set bond0 type bond xmit_hash_policy vlan+srcmac, creating the inconsistent state.
6. Destroy the bond interface: Run ip link del bond0; the kernel will attempt to unload the XDP program, hit the bond_xdp_check() guard, return -EOPNOTSUPP, and trigger WARN_ON, causing a denial-of-service condition (Red Hat Bugzilla).

• Logs: Kernel log entries (dmesg or /var/log/kern.log) containing WARN_ON related to dev_xdp_install on a bond device, or messages indicating -EOPNOTSUPP from bond_xdp_set.
• Network: Unexpected deletion or failure of bond network interfaces (e.g., bond0) that previously had XDP programs loaded.
• Process: Unusual use of ip link commands by non-root users with CAP_NET_ADMIN to modify bonding parameters, particularly changing xmit_hash_policy to vlan+srcmac on interfaces with active XDP programs.

Apply the upstream kernel patches available via the stable kernel tree for the affected version ranges: kernel versions prior to 6.6.130, 6.12.77, 6.18.17, and 6.19.7 should be updated to their respective fixed releases (git.kernel.org). As a configuration-based workaround, restrict bonding interface configuration capabilities to trusted administrators only (e.g., limit CAP_NET_ADMIN). Amazon Linux 2023 users can apply the fix via ALAS2023-2026-1543 or ALAS2023-2026-1596. Debian users should refer to the DSA advisory for their distribution's patched kernel package (Red Hat CVE).