CVE-2026-52975: Linux Kernel 802.3ad Bonding RCU Data-Race Vulnerability

Technical summary

CVE-2026-52975 is a data-race vulnerability in the Linux kernel's 802.3ad bonding implementation, specifically in the handling of the port->aggregator pointer. The KCSAN (Kernel Concurrency Sanitizer) detector identified unsynchronized concurrent access: ad_port_selection_logic() writes to the aggregator pointer while bond_3ad_get_active_agg_info() reads it without RCU protections. The resolution adds __rcu qualifiers to the pointer and implements proper RCU read-side critical sections to enforce memory ordering and prevent compiler/CPU optimizations from causing observable memory corruption or use-after-free conditions.

Business impact

Systems running affected Linux kernels with active 802.3ad bonded network interfaces face potential kernel crashes or memory corruption triggered by concurrent network configuration changes. This could lead to unplanned downtime for services relying on bonded network links, particularly in virtualized or high-availability deployments. The local privilege requirement means unprivileged users cannot directly trigger this, but administrators performing routine network reconfigurations or automated orchestration tools making network changes could inadvertently trigger the race condition.

Affected systems

The vulnerability affects the Linux kernel across all versions prior to the patch. It is specific to systems using 802.3ad (LACP) bonding mode for network interfaces. Impact is limited to systems where: (1) kernel bonding driver is compiled and active, (2) one or more bonded interfaces are configured in 802.3ad mode, and (3) concurrent access patterns occur between state machine updates and network attribute queries (e.g., via netlink).

Exploitability

Exploitability is moderate. The vulnerability requires local access and the ability to trigger concurrent operations on bonded interfaces—either through direct system calls (netlink socket manipulation) or automated network configuration. While not remotely exploitable, the race condition can be reliably reproduced in test environments with concurrent workloads. No known public exploit code exists at publication, and the defect manifests as a crash rather than providing a direct privilege escalation path, though memory corruption could theoretically be weaponized in advanced scenarios.

Remediation

Apply kernel patches that implement RCU synchronization for the port->aggregator pointer. The fix involves adding __rcu qualifiers to the aggregator pointer declaration and wrapping all reads with rcu_dereference() and all updates with proper RCU assignment macros. Verify the patch version against your Linux distribution's kernel security advisories. Alternatively, systems unable to patch immediately should minimize concurrent network configuration changes on bonded interfaces or temporarily disable 802.3ad mode if operationally feasible.

Patch guidance

Obtain the patched kernel version from your Linux distribution (Red Hat, Debian, Ubuntu, etc.) or kernel.org. The patch modifies drivers/net/bonding/bond_3ad.c to enforce RCU rules. Verify the patch against the vendor's security advisory to confirm the specific version number for your distribution. After patching, reboot the system or use live kernel patching if available. Test bonded interface failover and configuration queries post-patch to ensure normal operation.

Detection guidance

Monitor kernel logs (dmesg, systemd journal) for KCSAN warnings or use CONFIG_KCSAN=y kernels in test environments to detect the race condition. Observe for unexpected kernel crashes or warnings mentioning 'bond_3ad' or 'bond_3ad_state_machine_handler'. In production, track system stability metrics around network configuration changes on bonded interfaces. Network telemetry showing dropped traffic during bonded interface reconfigurations may indicate a related race condition triggering.

Why prioritize this

This issue merits prompt but not critical prioritization. The CVSS score of 7.8 (HIGH) reflects local access requirements and high impact (crash/corruption). Prioritize patches for production systems running 802.3ad bonding in active-active or active-passive failover scenarios where network reconfigurations are frequent. Non-bonded systems or those using other bonding modes are unaffected. Organizations with automated network orchestration should patch sooner due to higher concurrency likelihood.

Risk score, explained

The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H score of 7.8 reflects: Attack Vector Local (system access required), Attack Complexity Low (race condition is reproducible), Privileges Required Low (any local user can trigger via netlink), no User Interaction needed, Scope Unchanged, and High impact on Confidentiality, Integrity, and Availability (kernel crash or memory corruption). The score appropriately captures the severity while accounting for the local-only attack surface.

Frequently asked questions