GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-52975 (GCVE-0-2026-52975)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:28 – Updated: 2026-08-05 12:32
VLAI
Title
bonding: 3ad: implement proper RCU rules for port->aggregator
Summary
In the Linux kernel, the following vulnerability has been resolved: bonding: 3ad: implement proper RCU rules for port->aggregator syzbot found a data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler [1] which hints at lack of proper RCU implementation. Add __rcu qualifier to port->aggregator, and add proper RCU API. [1] BUG: KCSAN: data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler write to 0xffff88813cf5c4b0 of 8 bytes by task 36 on cpu 0: ad_port_selection_logic drivers/net/bonding/bond_3ad.c:1659 [inline] bond_3ad_state_machine_handler+0x9d5/0x2d60 drivers/net/bonding/bond_3ad.c:2569 process_one_work kernel/workqueue.c:3302 [inline] process_scheduled_works+0x4f0/0x9c0 kernel/workqueue.c:3385 worker_thread+0x58a/0x780 kernel/workqueue.c:3466 kthread+0x22a/0x280 kernel/kthread.c:436 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 read to 0xffff88813cf5c4b0 of 8 bytes by task 22063 on cpu 1: __bond_3ad_get_active_agg_info drivers/net/bonding/bond_3ad.c:2858 [inline] bond_3ad_get_active_agg_info+0x8c/0x230 drivers/net/bonding/bond_3ad.c:2881 bond_fill_info+0xe0f/0x10f0 drivers/net/bonding/bond_netlink.c:853 rtnl_link_info_fill net/core/rtnetlink.c:906 [inline] rtnl_link_fill+0x1d7/0x4e0 net/core/rtnetlink.c:927 rtnl_fill_ifinfo+0xf8e/0x1380 net/core/rtnetlink.c:2168 rtmsg_ifinfo_build_skb+0x11c/0x1b0 net/core/rtnetlink.c:4453 rtmsg_ifinfo_event net/core/rtnetlink.c:4486 [inline] rtmsg_ifinfo+0x6d/0x110 net/core/rtnetlink.c:4495 __dev_notify_flags+0x76/0x390 net/core/dev.c:9790 netif_change_flags+0xac/0xd0 net/core/dev.c:9823 do_setlink+0x905/0x2950 net/core/rtnetlink.c:3180 rtnl_group_changelink net/core/rtnetlink.c:3813 [inline] __rtnl_newlink net/core/rtnetlink.c:3981 [inline] rtnl_newlink+0xf55/0x1400 net/core/rtnetlink.c:4109 rtnetlink_rcv_msg+0x64b/0x720 net/core/rtnetlink.c:6995 netlink_rcv_skb+0x123/0x220 net/netlink/af_netlink.c:2550 rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:7022 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x5a8/0x680 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x5c8/0x6f0 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:787 [inline] __sock_sendmsg net/socket.c:802 [inline] ____sys_sendmsg+0x563/0x5b0 net/socket.c:2698 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2752 __sys_sendmsg net/socket.c:2784 [inline] __do_sys_sendmsg net/socket.c:2789 [inline] __se_sys_sendmsg net/socket.c:2787 [inline] __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2787 x64_sys_call+0x194c/0x3020 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x0000000000000000 -> 0xffff88813cf5c400 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 22063 Comm: syz.0.31122 Tainted: G W syzkaller #0 PREEMPT(full) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 , < ba2272be04f0cb1e74e1e355ff32ef95df280731 (git)
Affected: 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 , < 3b7265b3a82f40d2357c4004b26eb794a095b186 (git)
Affected: 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 , < 5fb9ea4e8ebf514d92df2b6c9d0db25ba02ac735 (git)
Affected: 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 , < c169c5837525ad842df6a542facf52b6f866a519 (git)
Affected: 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 , < 78f409fd34fe9de2b24ad8e9dca1b4608a48ed3d (git)
Affected: 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 , < c4f050ce06c56cfb5993268af4a5cb66ed1cd04e (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.13
Unaffected: 0 , < 3.13 (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.141 , ≤ 6.6.* (semver)
Unaffected: 6.12.95 , ≤ 6.12.* (semver)
Unaffected: 6.18.33 , ≤ 6.18.* (semver)
Unaffected: 7.0.10 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_3ad.c",
            "drivers/net/bonding/bond_main.c",
            "drivers/net/bonding/bond_netlink.c",
            "drivers/net/bonding/bond_procfs.c",
            "drivers/net/bonding/bond_sysfs_slave.c",
            "include/net/bond_3ad.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ba2272be04f0cb1e74e1e355ff32ef95df280731",
              "status": "affected",
              "version": "47e91f56008b43e1365e8d1d4a6813fe8a33b6f6",
              "versionType": "git"
            },
            {
              "lessThan": "3b7265b3a82f40d2357c4004b26eb794a095b186",
              "status": "affected",
              "version": "47e91f56008b43e1365e8d1d4a6813fe8a33b6f6",
              "versionType": "git"
            },
            {
              "lessThan": "5fb9ea4e8ebf514d92df2b6c9d0db25ba02ac735",
              "status": "affected",
              "version": "47e91f56008b43e1365e8d1d4a6813fe8a33b6f6",
              "versionType": "git"
            },
            {
              "lessThan": "c169c5837525ad842df6a542facf52b6f866a519",
              "status": "affected",
              "version": "47e91f56008b43e1365e8d1d4a6813fe8a33b6f6",
              "versionType": "git"
            },
            {
              "lessThan": "78f409fd34fe9de2b24ad8e9dca1b4608a48ed3d",
              "status": "affected",
              "version": "47e91f56008b43e1365e8d1d4a6813fe8a33b6f6",
              "versionType": "git"
            },
            {
              "lessThan": "c4f050ce06c56cfb5993268af4a5cb66ed1cd04e",
              "status": "affected",
              "version": "47e91f56008b43e1365e8d1d4a6813fe8a33b6f6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_3ad.c",
            "drivers/net/bonding/bond_main.c",
            "drivers/net/bonding/bond_netlink.c",
            "drivers/net/bonding/bond_procfs.c",
            "drivers/net/bonding/bond_sysfs_slave.c",
            "include/net/bond_3ad.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: 3ad: implement proper RCU rules for port-\u003eaggregator\n\nsyzbot found a data-race in bond_3ad_get_active_agg_info /\nbond_3ad_state_machine_handler [1] which hints at lack of proper\nRCU implementation.\n\nAdd __rcu qualifier to port-\u003eaggregator, and add proper RCU API.\n\n[1]\n\nBUG: KCSAN: data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler\n\nwrite to 0xffff88813cf5c4b0 of 8 bytes by task 36 on cpu 0:\n  ad_port_selection_logic drivers/net/bonding/bond_3ad.c:1659 [inline]\n  bond_3ad_state_machine_handler+0x9d5/0x2d60 drivers/net/bonding/bond_3ad.c:2569\n  process_one_work kernel/workqueue.c:3302 [inline]\n  process_scheduled_works+0x4f0/0x9c0 kernel/workqueue.c:3385\n  worker_thread+0x58a/0x780 kernel/workqueue.c:3466\n  kthread+0x22a/0x280 kernel/kthread.c:436\n  ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n\nread to 0xffff88813cf5c4b0 of 8 bytes by task 22063 on cpu 1:\n  __bond_3ad_get_active_agg_info drivers/net/bonding/bond_3ad.c:2858 [inline]\n  bond_3ad_get_active_agg_info+0x8c/0x230 drivers/net/bonding/bond_3ad.c:2881\n  bond_fill_info+0xe0f/0x10f0 drivers/net/bonding/bond_netlink.c:853\n  rtnl_link_info_fill net/core/rtnetlink.c:906 [inline]\n  rtnl_link_fill+0x1d7/0x4e0 net/core/rtnetlink.c:927\n  rtnl_fill_ifinfo+0xf8e/0x1380 net/core/rtnetlink.c:2168\n  rtmsg_ifinfo_build_skb+0x11c/0x1b0 net/core/rtnetlink.c:4453\n  rtmsg_ifinfo_event net/core/rtnetlink.c:4486 [inline]\n  rtmsg_ifinfo+0x6d/0x110 net/core/rtnetlink.c:4495\n  __dev_notify_flags+0x76/0x390 net/core/dev.c:9790\n  netif_change_flags+0xac/0xd0 net/core/dev.c:9823\n  do_setlink+0x905/0x2950 net/core/rtnetlink.c:3180\n  rtnl_group_changelink net/core/rtnetlink.c:3813 [inline]\n  __rtnl_newlink net/core/rtnetlink.c:3981 [inline]\n  rtnl_newlink+0xf55/0x1400 net/core/rtnetlink.c:4109\n  rtnetlink_rcv_msg+0x64b/0x720 net/core/rtnetlink.c:6995\n  netlink_rcv_skb+0x123/0x220 net/netlink/af_netlink.c:2550\n  rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:7022\n  netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]\n  netlink_unicast+0x5a8/0x680 net/netlink/af_netlink.c:1344\n  netlink_sendmsg+0x5c8/0x6f0 net/netlink/af_netlink.c:1894\n  sock_sendmsg_nosec net/socket.c:787 [inline]\n  __sock_sendmsg net/socket.c:802 [inline]\n  ____sys_sendmsg+0x563/0x5b0 net/socket.c:2698\n  ___sys_sendmsg+0x195/0x1e0 net/socket.c:2752\n  __sys_sendmsg net/socket.c:2784 [inline]\n  __do_sys_sendmsg net/socket.c:2789 [inline]\n  __se_sys_sendmsg net/socket.c:2787 [inline]\n  __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2787\n  x64_sys_call+0x194c/0x3020 arch/x86/include/generated/asm/syscalls_64.h:47\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nvalue changed: 0x0000000000000000 -\u003e 0xffff88813cf5c400\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 1 UID: 0 PID: 22063 Comm: syz.0.31122 Tainted: G        W           syzkaller #0 PREEMPT(full)\nTainted: [W]=WARN\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable paths are local bonding control/information paths such as rtnetlink, sysfs, and procfs racing with the 802.3ad workqueue. A remote packet alone is not sufficient for the complete race; a local attacker can exercise the reader and drive bond state changes.\nAC:L - A local attacker can create/configure an 802.3ad bond in a user/network namespace and repeatedly issue concurrent link queries while the bond workqueue updates port-\u003eaggregator. The race is attacker-influenced and does not depend on rare conditions outside the attacker\u0027s control.\nPR:L - Bond creation and many control operations require CAP_NET_ADMIN, but that is reachable by an unprivileged user inside a user namespace. RTM_GETLINK-style readers are even less restricted, but exploitation still assumes a local unprivileged user context.\nUI:N - No victim action is required once the attacker can run local commands or netlink requests. The attacker can trigger the relevant reader and writer activity directly.\nS:U - The impact remains within the kernel and the host networking subsystem security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is an RCU lifetime violation on port-\u003eaggregator, which points into per-slave ad_slave_info memory that can be cleared, freed, or reused. Treating the stale-pointer/UAF condition conservatively, it can expose kernel memory through groomed object reuse.\nI:H - A stale kernel pointer/UAF in attacker-controllable bonding state is a memory-safety issue that can plausibly be heap-groomed beyond a simple crash. Under the required overestimation rule, this supports high integrity impact.\nA:H - At minimum, racing dereferences of port-\u003eaggregator can lead to invalid pointer dereferences, inconsistent list traversal, oops, or panic. The vulnerability is therefore capable of causing a kernel-level denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:32:17.100Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ba2272be04f0cb1e74e1e355ff32ef95df280731"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b7265b3a82f40d2357c4004b26eb794a095b186"
        },
        {
          "url": "https://git.kernel.org/stable/c/5fb9ea4e8ebf514d92df2b6c9d0db25ba02ac735"
        },
        {
          "url": "https://git.kernel.org/stable/c/c169c5837525ad842df6a542facf52b6f866a519"
        },
        {
          "url": "https://git.kernel.org/stable/c/78f409fd34fe9de2b24ad8e9dca1b4608a48ed3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4f050ce06c56cfb5993268af4a5cb66ed1cd04e"
        }
      ],
      "title": "bonding: 3ad: implement proper RCU rules for port-\u003eaggregator",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-52975",
    "datePublished": "2026-06-24T16:28:52.514Z",
    "dateReserved": "2026-06-09T07:44:35.376Z",
    "dateUpdated": "2026-08-05T12:32:17.100Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-52975",
      "date": "2026-09-16",
      "epss": "0.00139",
      "percentile": "0.03617"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-09T14:44:43.000Z",
      "cve": "CVE-2026-52975",
      "id": "msrc_CVE-2026-52975",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bonding: 3ad: implement proper RCU rules for port-\u003eaggregator",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-52975.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-52975\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-24T17:17:08.050\",\"lastModified\":\"2026-07-14T16:52:32.697\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbonding: 3ad: implement proper RCU rules for port-\u003eaggregator\\n\\nsyzbot found a data-race in bond_3ad_get_active_agg_info /\\nbond_3ad_state_machine_handler [1] which hints at lack of proper\\nRCU implementation.\\n\\nAdd __rcu qualifier to port-\u003eaggregator, and add proper RCU API.\\n\\n[1]\\n\\nBUG: KCSAN: data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler\\n\\nwrite to 0xffff88813cf5c4b0 of 8 bytes by task 36 on cpu 0:\\n  ad_port_selection_logic drivers/net/bonding/bond_3ad.c:1659 [inline]\\n  bond_3ad_state_machine_handler+0x9d5/0x2d60 drivers/net/bonding/bond_3ad.c:2569\\n  process_one_work kernel/workqueue.c:3302 [inline]\\n  process_scheduled_works+0x4f0/0x9c0 kernel/workqueue.c:3385\\n  worker_thread+0x58a/0x780 kernel/workqueue.c:3466\\n  kthread+0x22a/0x280 kernel/kthread.c:436\\n  ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158\\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\\n\\nread to 0xffff88813cf5c4b0 of 8 bytes by task 22063 on cpu 1:\\n  __bond_3ad_get_active_agg_info drivers/net/bonding/bond_3ad.c:2858 [inline]\\n  bond_3ad_get_active_agg_info+0x8c/0x230 drivers/net/bonding/bond_3ad.c:2881\\n  bond_fill_info+0xe0f/0x10f0 drivers/net/bonding/bond_netlink.c:853\\n  rtnl_link_info_fill net/core/rtnetlink.c:906 [inline]\\n  rtnl_link_fill+0x1d7/0x4e0 net/core/rtnetlink.c:927\\n  rtnl_fill_ifinfo+0xf8e/0x1380 net/core/rtnetlink.c:2168\\n  rtmsg_ifinfo_build_skb+0x11c/0x1b0 net/core/rtnetlink.c:4453\\n  rtmsg_ifinfo_event net/core/rtnetlink.c:4486 [inline]\\n  rtmsg_ifinfo+0x6d/0x110 net/core/rtnetlink.c:4495\\n  __dev_notify_flags+0x76/0x390 net/core/dev.c:9790\\n  netif_change_flags+0xac/0xd0 net/core/dev.c:9823\\n  do_setlink+0x905/0x2950 net/core/rtnetlink.c:3180\\n  rtnl_group_changelink net/core/rtnetlink.c:3813 [inline]\\n  __rtnl_newlink net/core/rtnetlink.c:3981 [inline]\\n  rtnl_newlink+0xf55/0x1400 net/core/rtnetlink.c:4109\\n  rtnetlink_rcv_msg+0x64b/0x720 net/core/rtnetlink.c:6995\\n  netlink_rcv_skb+0x123/0x220 net/netlink/af_netlink.c:2550\\n  rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:7022\\n  netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]\\n  netlink_unicast+0x5a8/0x680 net/netlink/af_netlink.c:1344\\n  netlink_sendmsg+0x5c8/0x6f0 net/netlink/af_netlink.c:1894\\n  sock_sendmsg_nosec net/socket.c:787 [inline]\\n  __sock_sendmsg net/socket.c:802 [inline]\\n  ____sys_sendmsg+0x563/0x5b0 net/socket.c:2698\\n  ___sys_sendmsg+0x195/0x1e0 net/socket.c:2752\\n  __sys_sendmsg net/socket.c:2784 [inline]\\n  __do_sys_sendmsg net/socket.c:2789 [inline]\\n  __se_sys_sendmsg net/socket.c:2787 [inline]\\n  __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2787\\n  x64_sys_call+0x194c/0x3020 arch/x86/include/generated/asm/syscalls_64.h:47\\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\\n  do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\nvalue changed: 0x0000000000000000 -\u003e 0xffff88813cf5c400\\n\\nReported by Kernel Concurrency Sanitizer on:\\nCPU: 1 UID: 0 PID: 22063 Comm: syz.0.31122 Tainted: G        W           syzkaller #0 PREEMPT(full)\\nTainted: [W]=WARN\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/bonding/bond_3ad.c\",\"drivers/net/bonding/bond_main.c\",\"drivers/net/bonding/bond_netlink.c\",\"drivers/net/bonding/bond_procfs.c\",\"drivers/net/bonding/bond_sysfs_slave.c\",\"include/net/bond_3ad.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"47e91f56008b43e1365e8d1d4a6813fe8a33b6f6\",\"lessThan\":\"ba2272be04f0cb1e74e1e355ff32ef95df280731\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"47e91f56008b43e1365e8d1d4a6813fe8a33b6f6\",\"lessThan\":\"3b7265b3a82f40d2357c4004b26eb794a095b186\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"47e91f56008b43e1365e8d1d4a6813fe8a33b6f6\",\"lessThan\":\"5fb9ea4e8ebf514d92df2b6c9d0db25ba02ac735\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"47e91f56008b43e1365e8d1d4a6813fe8a33b6f6\",\"lessThan\":\"c169c5837525ad842df6a542facf52b6f866a519\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"47e91f56008b43e1365e8d1d4a6813fe8a33b6f6\",\"lessThan\":\"78f409fd34fe9de2b24ad8e9dca1b4608a48ed3d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"47e91f56008b43e1365e8d1d4a6813fe8a33b6f6\",\"lessThan\":\"c4f050ce06c56cfb5993268af4a5cb66ed1cd04e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/bonding/bond_3ad.c\",\"drivers/net/bonding/bond_main.c\",\"drivers/net/bonding/bond_netlink.c\",\"drivers/net/bonding/bond_procfs.c\",\"drivers/net/bonding/bond_sysfs_slave.c\",\"include/net/bond_3ad.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.141\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.95\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.33\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.10\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.13\",\"versionEndExcluding\":\"6.1.175\",\"matchCriteriaId\":\"543EEFCA-5033-4FCE-961F-931DA9209E59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.141\",\"matchCriteriaId\":\"97A9FFFA-22BB-4D5C-9790-5A2286E392F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.95\",\"matchCriteriaId\":\"4E206B86-E0E3-4394-A93F-39F2D50A8AA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.33\",\"matchCriteriaId\":\"96D99E49-380D-43AB-BDBA-25C3AD018A9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.10\",\"matchCriteriaId\":\"A13475D2-59BF-4716-94B5-7C1D239A2CF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3b7265b3a82f40d2357c4004b26eb794a095b186\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5fb9ea4e8ebf514d92df2b6c9d0db25ba02ac735\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78f409fd34fe9de2b24ad8e9dca1b4608a48ed3d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ba2272be04f0cb1e74e1e355ff32ef95df280731\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c169c5837525ad842df6a542facf52b6f866a519\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c4f050ce06c56cfb5993268af4a5cb66ed1cd04e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-04T13:04:33+00:00",
      "cve": "CVE-2026-52975",
      "id": "CVE-2026-52975",
      "initial_release_date": "2026-06-24T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bonding: 3ad: implement proper RCU rules for port-\u003eaggregator",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52975.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T02:03:12Z",
      "cve": "CVE-2026-52975",
      "id": "CVE-2026-52975",
      "initial_release_date": "2026-06-27T01:55:11Z",
      "product_status:first_fixed": "67",
      "product_status:known_affected": "744",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "187",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-52975",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-52975.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.