GHSA-PFQP-2WHQ-57G2
Vulnerability from github – Published: 2026-05-08 15:31 – Updated: 2026-05-11 09:30In the Linux kernel, the following vulnerability has been resolved:
net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which initializes it. If bonding ARP/NS validation is enabled, an IPv6 NS/NA packet received on a slave can reach bond_validate_na(), which calls bond_has_this_ip6(). That path calls ipv6_chk_addr() and can crash in __ipv6_chk_addr_and_flags().
BUG: kernel NULL pointer dereference, address: 00000000000005d8 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:__ipv6_chk_addr_and_flags+0x69/0x170 Call Trace: ipv6_chk_addr+0x1f/0x30 bond_validate_na+0x12e/0x1d0 [bonding] ? __pfx_bond_handle_frame+0x10/0x10 [bonding] bond_rcv_validate+0x1a0/0x450 [bonding] bond_handle_frame+0x5e/0x290 [bonding] ? srso_alias_return_thunk+0x5/0xfbef5 __netif_receive_skb_core.constprop.0+0x3e8/0xe50 ? srso_alias_return_thunk+0x5/0xfbef5 ? update_cfs_rq_load_avg+0x1a/0x240 ? srso_alias_return_thunk+0x5/0xfbef5 ? __enqueue_entity+0x5e/0x240 __netif_receive_skb_one_core+0x39/0xa0 process_backlog+0x9c/0x150 __napi_poll+0x30/0x200 ? srso_alias_return_thunk+0x5/0xfbef5 net_rx_action+0x338/0x3b0 handle_softirqs+0xc9/0x2a0 do_softirq+0x42/0x60 __local_bh_enable_ip+0x62/0x70 __dev_queue_xmit+0x2d3/0x1000 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? packet_parse_headers+0x10a/0x1a0 packet_sendmsg+0x10da/0x1700 ? kick_pool+0x5f/0x140 ? srso_alias_return_thunk+0x5/0xfbef5 ? __queue_work+0x12d/0x4f0 __sys_sendto+0x1f3/0x220 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x101/0xf80 ? exc_page_fault+0x6e/0x170 ? srso_alias_return_thunk+0x5/0xfbef5 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fix this by checking ipv6_mod_enabled() before dispatching IPv6 packets to bond_na_rcv(). If IPv6 is disabled, return early from bond_rcv_validate() and avoid the path to ipv6_chk_addr().
{
"affected": [],
"aliases": [
"CVE-2026-43441"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-08T15:16:56Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled\n\nWhen booting with the \u0027ipv6.disable=1\u0027 parameter, the nd_tbl is never\ninitialized because inet6_init() exits before ndisc_init() is called\nwhich initializes it. If bonding ARP/NS validation is enabled, an IPv6\nNS/NA packet received on a slave can reach bond_validate_na(), which\ncalls bond_has_this_ip6(). That path calls ipv6_chk_addr() and can\ncrash in __ipv6_chk_addr_and_flags().\n\n BUG: kernel NULL pointer dereference, address: 00000000000005d8\n Oops: Oops: 0000 [#1] SMP NOPTI\n RIP: 0010:__ipv6_chk_addr_and_flags+0x69/0x170\n Call Trace:\n \u003cIRQ\u003e\n ipv6_chk_addr+0x1f/0x30\n bond_validate_na+0x12e/0x1d0 [bonding]\n ? __pfx_bond_handle_frame+0x10/0x10 [bonding]\n bond_rcv_validate+0x1a0/0x450 [bonding]\n bond_handle_frame+0x5e/0x290 [bonding]\n ? srso_alias_return_thunk+0x5/0xfbef5\n __netif_receive_skb_core.constprop.0+0x3e8/0xe50\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? update_cfs_rq_load_avg+0x1a/0x240\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __enqueue_entity+0x5e/0x240\n __netif_receive_skb_one_core+0x39/0xa0\n process_backlog+0x9c/0x150\n __napi_poll+0x30/0x200\n ? srso_alias_return_thunk+0x5/0xfbef5\n net_rx_action+0x338/0x3b0\n handle_softirqs+0xc9/0x2a0\n do_softirq+0x42/0x60\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n __local_bh_enable_ip+0x62/0x70\n __dev_queue_xmit+0x2d3/0x1000\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? packet_parse_headers+0x10a/0x1a0\n packet_sendmsg+0x10da/0x1700\n ? kick_pool+0x5f/0x140\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __queue_work+0x12d/0x4f0\n __sys_sendto+0x1f3/0x220\n __x64_sys_sendto+0x24/0x30\n do_syscall_64+0x101/0xf80\n ? exc_page_fault+0x6e/0x170\n ? srso_alias_return_thunk+0x5/0xfbef5\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\nFix this by checking ipv6_mod_enabled() before dispatching IPv6 packets to\nbond_na_rcv(). If IPv6 is disabled, return early from bond_rcv_validate()\nand avoid the path to ipv6_chk_addr().",
"id": "GHSA-pfqp-2whq-57g2",
"modified": "2026-05-11T09:30:31Z",
"published": "2026-05-08T15:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43441"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/30021e969d48e5819d5ae56936c2f34c0f7ce997"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/49dbfcb70eca5f6f9043594e1e323c74c39e3863"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/95faa1459b83fa544191e82ccc73856f03b7741f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c78f01abe535853f13f0b26cd5b1d2f19bf52e2f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c9c238066fb254dabf65e27379f93c56112c5b96"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cf6099ef493b94e140b0fad52482a78853115318"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.