CVE-2026-53337 Details

A NULL pointer dereference vulnerability has been identified in the Linux kernel bonding driver. The issue arises in the 'bond_do_ioctl' function, where the 'slave_dev' variable is assigned using '__dev_get_by_name()'. This function can return NULL if the specified interface name does not exist. The vulnerability occurs because the 'slave_dbg()' call, which logs the 'slave_dev' pointer, is made before checking if 'slave_dev' is NULL. This oversight leads to a kernel oops, a type of error caused by dereferencing a NULL pointer, when a user invokes bonding ioctls (such as SIOCBONDENSLAVE or SIOCBONDRELEASE) with a non-existent slave interface name. This vulnerability can be exploited from userspace by using the bonding ioctl interface, provided the CAP_NET_ADMIN capability is available, creating a potential local denial-of-service scenario.

The vulnerability has been fixed by adjusting the order of operations in the 'bond_do_ioctl' function. The 'slave_dbg()' call has been moved to occur after the NULL check for 'slave_dev', preventing the dereference of a NULL pointer. Users should apply the latest patches available in the Linux kernel stable tree to address this issue.