CVE-2026-74726: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-74726 is a race condition vulnerability in the Linux kernel's bonding ALB (Adaptive Load Balancing) monitor that can lead to a null pointer dereference and kernel panic. The flaw exists in bond_alb_monitor() within drivers/net/bonding/bond_alb.c, introduced as of Linux kernel 2.6.24. Fixed versions include 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2+. It carries an estimated CVSS severity of Medium (GitHub Advisory, Feedly).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (related to CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization). bond_alb_monitor() reads primary_is_promisc under RCU lock, then drops RCU and acquires RTNL via rtnl_trylock(). In the window between these two lock operations, the active slave can change via RTM_DELLINK → __bond_release_one() → bond_alb_handle_active_change(), which already clears primary_is_promisc and drops promiscuity. The monitor then acts on a stale decision: if the slave was removed with no failover, curr_active_slave is NULL and dereferencing it causes a general protection fault; if failover occurred, the stale dev_set_promiscuity(-1) underflows the new slave's promiscuity counter, permanently pinning it in IFF_PROMISC. The fix re-checks primary_is_promisc and curr_active_slave after acquiring RTNL, consistent with how other bonding monitors (bond_miimon_commit, bond_ab_arp_commit) already operate (GitHub Advisory).

Successful triggering of this vulnerability causes an immediate kernel panic and system crash (denial of service), as evidenced by the reported KASAN: null-ptr-deref and Kernel panic - not syncing: Fatal exception in the workqueue context. A secondary impact is the permanent enabling of IFF_PROMISC on a network interface (if the failover path is taken), which could cause unintended capture of all network traffic on that interface, potentially exposing sensitive data. The vulnerability affects any Linux system using bonding in ALB mode with active slave management (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-74726. Exploitation requires local access to a system running the Linux kernel with bonding in ALB mode, and the race condition must be triggered by concurrent slave removal and the ALB monitor workqueue execution — making reliable exploitation difficult. No EPSS score or CISA KEV catalog entry is currently associated with this CVE. The vulnerability was detected by Nessus plugin 339005 (Tenable).

• Logs/Kernel Messages: Kernel oops messages containing KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] and Workqueue: b42 bond_alb_monitor in /var/log/kern.log or dmesg output.
• Logs/Kernel Messages: Stack trace referencing bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600) followed by Kernel panic - not syncing: Fatal exception.
• Network: Network interface unexpectedly set to promiscuous mode (IFF_PROMISC) on a bonding slave interface, detectable via ip link show or ifconfig showing PROMISC flag without administrative intent.
• System Behavior: Unexpected system reboots or crashes on hosts using bonded network interfaces in ALB mode, particularly coinciding with slave removal or failover events.

Update the Linux kernel to a patched version: 5.10.265+, 5.15.216+, 6.1.183+, 6.6.152+, 6.12.104+, 6.18.45+, 7.1.9+, or 7.2+. The fix is available via stable kernel commits including f7668762bf5f, 09add8d5cfa9, b82f51681a7a, dd148539fb47, dccec0227ed8, 2faf75a8a065, 257c4a3a34d8, and 683c6ba6e58e. As a temporary workaround where patching is not immediately possible, avoid using bonding in ALB mode or restrict dynamic slave removal on affected systems. Linux distribution vendors (Debian, etc.) are expected to backport the fix to their supported kernel packages (GitHub Advisory).