In the Linux kernel, the following vulnerability has been resolved:
net: bonding: fix use-after-free after 802.3ad slave unbind
commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"), resolve case, when there is several aggregation groups in the same bond. bond_3ad_unbind_slave will invalidate (clear) aggregator when __agg_active_ports return zero. So, ad_clear_agg can be executed even, when num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for, previously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave will not update slave ports list, because lag_ports==NULL. So, here we got slave ports, pointing to freed aggregator memory.
Fix with checking actual number of ports in group (as was before commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") ), before ad_clear_agg().
The KASAN logs are as follows:
[ 767.617392] ================================================================== [ 767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler+0x13dc/0x1470 [ 767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767 [ 767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G O 5.15.11 #15 [ 767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT) [ 767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler [ 767.666468] Call trace: [ 767.668930] dump_backtrace+0x0/0x2d0 [ 767.672625] show_stack+0x24/0x30 [ 767.675965] dump_stack_lvl+0x68/0x84 [ 767.679659] print_address_description.constprop.0+0x74/0x2b8 [ 767.685451] kasan_report+0x1f0/0x260 [ 767.689148] __asan_load2+0x94/0xd0 [ 767.692667] bond_3ad_state_machine_handler+0x13dc/0x1470
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-toolsUpgrade kernelUpgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernel-livepatch-5.10.130-118.517Upgrade kernel-livepatch-4.14.287-215.504Upgrade kernel-debuginfoUpgrade kernel-livepatch-5.15.54-25.126Upgrade kernel-tools-develUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-devel | Mar 14, 2025 | Feb 26, 2025 |
| Debian | — | Upgrade linux | Feb 27, 2025 | Feb 27, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade python3-perfUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Jun 11, 2025 | Feb 26, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernelUpgrade python3-perfUpgrade kernel-tools | Jun 11, 2025 | Feb 26, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 26, 2025 |
| Ubuntu | — | Upgrade linux-gcp-5.4Upgrade linux-awsUpgrade linux-gcp-4.15Upgrade linux-raspi-5.4Upgrade linux-realtimeUpgrade linux-azure-5.4Upgrade linux-hwe-5.4Upgrade linux-intel-iotg-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-gcp-fipsUpgrade linux-iotUpgrade linux-gcpUpgrade linux-hweUpgrade linux-azure-4.15Upgrade linux-gcp-5.15Upgrade linux-bluefieldUpgrade linux-hwe-5.15Upgrade linux-azureUpgrade linux-raspiUpgrade linux-gkeUpgrade linuxUpgrade linux-azure-fipsUpgrade linux-riscv-5.15Upgrade linux-oracle-5.15Upgrade linux-oracleUpgrade linux-ibmUpgrade linux-aws-fipsUpgrade linux-aws-5.4Upgrade linux-aws-hweUpgrade linux-ibm-5.4Upgrade linux-nvidiaUpgrade linux-azure-5.15Upgrade linux-azure-fdeUpgrade linux-gkeopUpgrade linux-oracle-5.4Upgrade linux-lowlatencyUpgrade linux-intel-iotgUpgrade linux-kvmUpgrade linux-aws-5.15Upgrade linux-fips | Mar 3, 2025 | Feb 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Feb 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub