The Linux kernel bonding driver 3ad implementation had a data-race condition in bond_3ad_get_active_agg_info and bond_3ad_state_machine_handler functions due to missing proper RCU synchronization on the port->aggregator pointer. This was detected by Kernel Concurrency Sanitizer (KCSAN) as concurrent read and write accesses to the same memory location without proper synchronization. The vulnerability was addressed by adding the __rcu qualifier to port->aggregator and implementing correct RCU API usage to prevent data races and ensure thread-safe access.

The vulnerability allows concurrent unsynchronized access to kernel memory, potentially causing data corruption, kernel crashes, or system instability. Given the high CVSS vector metrics (local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability), exploitation could lead to full compromise of the affected system's kernel integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates that a fix has been implemented in the Linux kernel bonding driver by adding proper RCU synchronization. Users should monitor official Linux kernel releases and apply updates that include this fix once available.