VulnerabilityPublished 25 Sep 2026Updated 19 Oct 2026

CVE-2026-98089: Linux kernel · bonding: alb: fix uninitialized transport header access in alb_determine_nd()

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in e39cf90bd856443542b97933289749fca07476bf : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in e39cf90bd856443542b97933289749fca07476bf, 27314f96d29b54e815e7a9b84c3273f1895e68e2, 862c8eb6947689c44fe11353755576a3672563a5 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549, < e39cf90bd856443542b97933289749fca07476bf	Fixed in e39cf90bd856443542b97933289749fca07476bf
LinuxLinux	Affected ≥ 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549, < 27314f96d29b54e815e7a9b84c3273f1895e68e2	Fixed in 27314f96d29b54e815e7a9b84c3273f1895e68e2
LinuxLinux	Affected ≥ 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549, < 862c8eb6947689c44fe11353755576a3672563a5	Fixed in 862c8eb6947689c44fe11353755576a3672563a5
LinuxLinux	Affected ≥ 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549, < 70f3995830d3f1e79faa14eb0605914f778feca9	Fixed in 70f3995830d3f1e79faa14eb0605914f778feca9
LinuxLinux	Affected ≥ 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549, < 7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99	Fixed in 7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99
LinuxLinux	Affected ≥ 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549, < 3b178894931a268c09126a5b53630f343e10e296	Fixed in 3b178894931a268c09126a5b53630f343e10e296

AI-suggested

A fix is available and has been applied in the Linux kernel source as indicated by the fixed commit hashes. Users should update to a kernel version including these fixes to remediate the vulnerability.

Description

A vulnerability in the Linux kernel bonding driver (ALB) was fixed to address uninitialized transport header access in the alb_determine_nd() function. The flaw involved dereferencing an ICMPv6 header pointer without guaranteed initialization of the transport header in certain packet transmission paths, potentially leading to out-of-bounds memory access.

Impact

The vulnerability could lead to out-of-bounds memory access in kernel space, which may cause kernel crashes or potentially enable further exploitation depending on the context. However, no known exploits in the wild have been reported.

Summary

The Linux kernel bonding driver ALB mode's alb_determine_nd() function improperly accessed the ICMPv6 transport header using icmp6_hdr(skb) without ensuring skb->transport_header was initialized. This occurs in transmit paths such as packets sent via AF_PACKET/raw sockets or forwarded packets, where skb->transport_header may be uninitialized. Although pskb_network_may_pull() ensures linear packet data from the network header, it does not set or adjust the transport header offset, causing icmp6_hdr(skb) to potentially dereference out-of-bounds memory. The fix involves fetching the ICMPv6 header directly after the IPv6 header following pskb_network_may_pull() and reloading the IPv6 header if skb->head is reallocated, also removing an unused argument from the function.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 12:43 UTC

Technical details

References

Community reviews

Related threats