CVE-2026-31546
type: TechArticle
description: In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix NULL deref in bond_debug_rlb_hash_show rlb_clear_slave intentionally keeps RLB hash-table entries on the rx_hashtbl_used_head list with slave set to NULL when no replacement slave is available. However, bond_debug_rlb_hash_show visites client_info->slave without checking if it's NULL. Other used-list iterators in bond_alb.c already handle this NULL-slave state safely: - rlb_update_client returns early on !client_info->slave - rlb_req_update_slave_clients, rlb_clear_slave, and rlb_rebalance compare slave values before visiting - lb_req_update_subnet_clients continues if slave is NULL The following NULL deref crash can be trigger in bond_debug_rlb_hash_show: [ 1.289791] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 1.292058] RIP: 0010:bond_debug_rlb_hash_show (drivers/net/bonding/bond_debugfs.c:41) [ 1.293101] RSP: 0018:ffffc900004a7d00 EFLAGS: 00010286 [ 1.293333]
date published: 2026-04-24T15:16:28.690
license: https://creativecommons.org/publicdomain/zero/1.0/
source: https://nvd.nist.gov/vuln/detail/CVE-2026-31546
publisher: AI Analytics
source organization: NIST National Vulnerability Database
main entity: Thing
  additional type: Vulnerability
  score: 5.5
  severity: MEDIUM
keywords: CWE-476

AI Analytics
type: Organization