The Linux kernel bonding driver function bond_alb_monitor() originally read the primary_is_promisc flag under RCU, then dropped RCU and took RTNL lock via rtnl_trylock() before undoing promiscuity settings on the active slave device. During this window, the active slave could change, causing the monitor to act on stale state. This led to either a null pointer dereference if the slave was removed without failover or an underflow of the promiscuity counter if failover occurred, potentially pinning the new slave in promiscuous mode. The fix involved re-checking primary_is_promisc and curr_active_slave after acquiring RTNL lock to ensure the monitor only undoes increments it still owns, aligning with how other bonding monitors handle state under RTNL.

Exploitation of this vulnerability can cause kernel crashes (general protection faults) and kernel panic due to null pointer dereference or incorrect promiscuity counter manipulation. This can lead to denial of service on affected systems running the vulnerable Linux kernel bonding driver.

A fix has been implemented in the Linux kernel to re-check the primary_is_promisc flag and curr_active_slave under RTNL lock before undoing promiscuity changes, preventing stale state usage. Users should update to a Linux kernel version that includes this fix. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories or vendor updates for the exact fixed version and apply the update accordingly.