CVE-2026-23310 (GCVE-0-2026-23310)

Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-06-19 11:57
VLAI
Title
bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded bond_option_mode_set() already rejects mode changes that would make a loaded XDP program incompatible via bond_xdp_check(). However, bond_option_xmit_hash_policy_set() has no such guard. For 802.3ad and balance-xor modes, bond_xdp_check() returns false when xmit_hash_policy is vlan+srcmac, because the 802.1q payload is usually absent due to hardware offload. This means a user can: 1. Attach a native XDP program to a bond in 802.3ad/balance-xor mode with a compatible xmit_hash_policy (e.g. layer2+3). 2. Change xmit_hash_policy to vlan+srcmac while XDP remains loaded. This leaves bond->xdp_prog set but bond_xdp_check() now returning false for the same device. When the bond is later destroyed, dev_xdp_uninstall() calls bond_xdp_set(dev, NULL, NULL) to remove the program, which hits the bond_xdp_check() guard and returns -EOPNOTSUPP, triggering: WARN_ON(dev_xdp_install(dev, mode, bpf_op, NULL, 0, NULL)) Fix this by rejecting xmit_hash_policy changes to vlan+srcmac when an XDP program is loaded on a bond in 802.3ad or balance-xor mode. commit 39a0876d595b ("net, bonding: Disallow vlan+srcmac with XDP") introduced bond_xdp_check() which returns false for 802.3ad/balance-xor modes when xmit_hash_policy is vlan+srcmac. The check was wired into bond_xdp_set() to reject XDP attachment with an incompatible policy, but the symmetric path -- preventing xmit_hash_policy from being changed to an incompatible value after XDP is already loaded -- was left unguarded in bond_option_xmit_hash_policy_set(). Note: commit 094ee6017ea0 ("bonding: check xdp prog when set bond mode") later added a similar guard to bond_option_mode_set(), but bond_option_xmit_hash_policy_set() remained unprotected.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 39a0876d595bd7c7512782dfcce0ee66f65bf221 , < 0a80e6ecaf669c77260b44254f4a84d76bf83e89 (git)
Affected: 39a0876d595bd7c7512782dfcce0ee66f65bf221 , < 5c262bd0e39320a6d6c8277cb8349ce21c01b8c1 (git)
Affected: 39a0876d595bd7c7512782dfcce0ee66f65bf221 , < d36ad7e126c6a0c5f699583309ccc37e3a3263ea (git)
Affected: 39a0876d595bd7c7512782dfcce0ee66f65bf221 , < 0ace8027e41f6f094ef6c1aca42d2ed6cd7af54e (git)
Affected: 39a0876d595bd7c7512782dfcce0ee66f65bf221 , < e85fa809e507b9d8eff4840888b8c727e4e8448c (git)
Affected: 39a0876d595bd7c7512782dfcce0ee66f65bf221 , < 479d589b40b836442bbdadc3fdb37f001bb67f26 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.77 , ≤ 6.12.* (semver)
Unaffected: 6.18.17 , ≤ 6.18.* (semver)
Unaffected: 6.19.7 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_main.c",
            "drivers/net/bonding/bond_options.c",
            "include/net/bonding.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0a80e6ecaf669c77260b44254f4a84d76bf83e89",
              "status": "affected",
              "version": "39a0876d595bd7c7512782dfcce0ee66f65bf221",
              "versionType": "git"
            },
            {
              "lessThan": "5c262bd0e39320a6d6c8277cb8349ce21c01b8c1",
              "status": "affected",
              "version": "39a0876d595bd7c7512782dfcce0ee66f65bf221",
              "versionType": "git"
            },
            {
              "lessThan": "d36ad7e126c6a0c5f699583309ccc37e3a3263ea",
              "status": "affected",
              "version": "39a0876d595bd7c7512782dfcce0ee66f65bf221",
              "versionType": "git"
            },
            {
              "lessThan": "0ace8027e41f6f094ef6c1aca42d2ed6cd7af54e",
              "status": "affected",
              "version": "39a0876d595bd7c7512782dfcce0ee66f65bf221",
              "versionType": "git"
            },
            {
              "lessThan": "e85fa809e507b9d8eff4840888b8c727e4e8448c",
              "status": "affected",
              "version": "39a0876d595bd7c7512782dfcce0ee66f65bf221",
              "versionType": "git"
            },
            {
              "lessThan": "479d589b40b836442bbdadc3fdb37f001bb67f26",
              "status": "affected",
              "version": "39a0876d595bd7c7512782dfcce0ee66f65bf221",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_main.c",
            "drivers/net/bonding/bond_options.c",
            "include/net/bonding.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.17",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.7",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded\n\nbond_option_mode_set() already rejects mode changes that would make a\nloaded XDP program incompatible via bond_xdp_check().  However,\nbond_option_xmit_hash_policy_set() has no such guard.\n\nFor 802.3ad and balance-xor modes, bond_xdp_check() returns false when\nxmit_hash_policy is vlan+srcmac, because the 802.1q payload is usually\nabsent due to hardware offload.  This means a user can:\n\n1. Attach a native XDP program to a bond in 802.3ad/balance-xor mode\n   with a compatible xmit_hash_policy (e.g. layer2+3).\n2. Change xmit_hash_policy to vlan+srcmac while XDP remains loaded.\n\nThis leaves bond-\u003exdp_prog set but bond_xdp_check() now returning false\nfor the same device.  When the bond is later destroyed, dev_xdp_uninstall()\ncalls bond_xdp_set(dev, NULL, NULL) to remove the program, which hits\nthe bond_xdp_check() guard and returns -EOPNOTSUPP, triggering:\n\nWARN_ON(dev_xdp_install(dev, mode, bpf_op, NULL, 0, NULL))\n\nFix this by rejecting xmit_hash_policy changes to vlan+srcmac when an\nXDP program is loaded on a bond in 802.3ad or balance-xor mode.\n\ncommit 39a0876d595b (\"net, bonding: Disallow vlan+srcmac with XDP\")\nintroduced bond_xdp_check() which returns false for 802.3ad/balance-xor\nmodes when xmit_hash_policy is vlan+srcmac.  The check was wired into\nbond_xdp_set() to reject XDP attachment with an incompatible policy, but\nthe symmetric path -- preventing xmit_hash_policy from being changed to an\nincompatible value after XDP is already loaded -- was left unguarded in\nbond_option_xmit_hash_policy_set().\n\nNote:\ncommit 094ee6017ea0 (\"bonding: check xdp prog when set bond mode\")\nlater added a similar guard to bond_option_mode_set(), but\nbond_option_xmit_hash_policy_set() remained unprotected."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-19T11:57:33.669Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0a80e6ecaf669c77260b44254f4a84d76bf83e89"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c262bd0e39320a6d6c8277cb8349ce21c01b8c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d36ad7e126c6a0c5f699583309ccc37e3a3263ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ace8027e41f6f094ef6c1aca42d2ed6cd7af54e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e85fa809e507b9d8eff4840888b8c727e4e8448c"
        },
        {
          "url": "https://git.kernel.org/stable/c/479d589b40b836442bbdadc3fdb37f001bb67f26"
        }
      ],
      "title": "bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23310",
    "datePublished": "2026-03-25T10:27:05.943Z",
    "dateReserved": "2026-01-13T15:37:45.994Z",
    "dateUpdated": "2026-06-19T11:57:33.669Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23310",
      "date": "2026-09-27",
      "epss": "0.00123",
      "percentile": "0.01774"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/bonding/bond_main.c",
                  "drivers/net/bonding/bond_options.c",
                  "include/net/bonding.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0a80e6ecaf669c77260b44254f4a84d76bf83e89",
                    "status": "affected",
                    "version": "39a0876d595bd7c7512782dfcce0ee66f65bf221",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5c262bd0e39320a6d6c8277cb8349ce21c01b8c1",
                    "status": "affected",
                    "version": "39a0876d595bd7c7512782dfcce0ee66f65bf221",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d36ad7e126c6a0c5f699583309ccc37e3a3263ea",
                    "status": "affected",
                    "version": "39a0876d595bd7c7512782dfcce0ee66f65bf221",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0ace8027e41f6f094ef6c1aca42d2ed6cd7af54e",
                    "status": "affected",
                    "version": "39a0876d595bd7c7512782dfcce0ee66f65bf221",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e85fa809e507b9d8eff4840888b8c727e4e8448c",
                    "status": "affected",
                    "version": "39a0876d595bd7c7512782dfcce0ee66f65bf221",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "479d589b40b836442bbdadc3fdb37f001bb67f26",
                    "status": "affected",
                    "version": "39a0876d595bd7c7512782dfcce0ee66f65bf221",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/bonding/bond_main.c",
                  "drivers/net/bonding/bond_options.c",
                  "include/net/bonding.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.130",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.77",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.17",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E265D934-61CB-43A3-82C6-6D0F5B6DD9D1",
                    "versionEndExcluding": "6.6.130",
                    "versionStartIncluding": "5.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B3D12E00-E42D-4056-B354-BAD4903C03A5",
                    "versionEndExcluding": "6.12.77",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A5E006E4-59C7-43C1-9231-62A72219F2BA",
                    "versionEndExcluding": "6.18.17",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3",
                    "versionEndExcluding": "6.19.7",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded\n\nbond_option_mode_set() already rejects mode changes that would make a\nloaded XDP program incompatible via bond_xdp_check().  However,\nbond_option_xmit_hash_policy_set() has no such guard.\n\nFor 802.3ad and balance-xor modes, bond_xdp_check() returns false when\nxmit_hash_policy is vlan+srcmac, because the 802.1q payload is usually\nabsent due to hardware offload.  This means a user can:\n\n1. Attach a native XDP program to a bond in 802.3ad/balance-xor mode\n   with a compatible xmit_hash_policy (e.g. layer2+3).\n2. Change xmit_hash_policy to vlan+srcmac while XDP remains loaded.\n\nThis leaves bond-\u003exdp_prog set but bond_xdp_check() now returning false\nfor the same device.  When the bond is later destroyed, dev_xdp_uninstall()\ncalls bond_xdp_set(dev, NULL, NULL) to remove the program, which hits\nthe bond_xdp_check() guard and returns -EOPNOTSUPP, triggering:\n\nWARN_ON(dev_xdp_install(dev, mode, bpf_op, NULL, 0, NULL))\n\nFix this by rejecting xmit_hash_policy changes to vlan+srcmac when an\nXDP program is loaded on a bond in 802.3ad or balance-xor mode.\n\ncommit 39a0876d595b (\"net, bonding: Disallow vlan+srcmac with XDP\")\nintroduced bond_xdp_check() which returns false for 802.3ad/balance-xor\nmodes when xmit_hash_policy is vlan+srcmac.  The check was wired into\nbond_xdp_set() to reject XDP attachment with an incompatible policy, but\nthe symmetric path -- preventing xmit_hash_policy from being changed to an\nincompatible value after XDP is already loaded -- was left unguarded in\nbond_option_xmit_hash_policy_set().\n\nNote:\ncommit 094ee6017ea0 (\"bonding: check xdp prog when set bond mode\")\nlater added a similar guard to bond_option_mode_set(), but\nbond_option_xmit_hash_policy_set() remained unprotected."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbpf/bonding: rechazar el cambio de pol\u00edtica de hash de transmisi\u00f3n (xmit_hash_policy) a vlan+srcmac cuando XDP est\u00e1 cargado\n\nbond_option_mode_set() ya rechaza los cambios de modo que har\u00edan incompatible un programa XDP cargado a trav\u00e9s de bond_xdp_check(). Sin embargo, bond_option_xmit_hash_policy_set() no tiene tal protecci\u00f3n.\n\nPara los modos 802.3ad y balance-xor, bond_xdp_check() devuelve falso cuando la pol\u00edtica de hash de transmisi\u00f3n (xmit_hash_policy) es vlan+srcmac, porque la carga \u00fatil 802.1q suele estar ausente debido a la descarga de hardware. Esto significa que un usuario puede:\n\n1. Adjuntar un programa XDP nativo a un bond en modo 802.3ad/balance-xor con una pol\u00edtica de hash de transmisi\u00f3n (xmit_hash_policy) compatible (por ejemplo, capa2+3).\n2. Cambiar la pol\u00edtica de hash de transmisi\u00f3n (xmit_hash_policy) a vlan+srcmac mientras XDP permanece cargado.\n\nEsto deja bond-\u0026gt;xdp_prog establecido, pero bond_xdp_check() ahora devuelve falso para el mismo dispositivo. Cuando el bond es destruido posteriormente, dev_xdp_uninstall() llama a bond_xdp_set(dev, NULL, NULL) para eliminar el programa, lo que activa la protecci\u00f3n de bond_xdp_check() y devuelve -EOPNOTSUPP, desencadenando:\n\nWARN_ON(dev_xdp_install(dev, mode, bpf_op, NULL, 0, NULL))\n\nSolucione esto rechazando los cambios de pol\u00edtica de hash de transmisi\u00f3n (xmit_hash_policy) a vlan+srcmac cuando un programa XDP est\u00e1 cargado en un bond en modo 802.3ad o balance-xor.\n\nEl commit 39a0876d595b (\u0027net, bonding: No permitir vlan+srcmac con XDP\u0027) introdujo bond_xdp_check() que devuelve falso para los modos 802.3ad/balance-xor cuando la pol\u00edtica de hash de transmisi\u00f3n (xmit_hash_policy) es vlan+srcmac. La verificaci\u00f3n se integr\u00f3 en bond_xdp_set() para rechazar la asociaci\u00f3n de XDP con una pol\u00edtica incompatible, pero la ruta sim\u00e9trica -- impidiendo que la pol\u00edtica de hash de transmisi\u00f3n (xmit_hash_policy) se cambie a un valor incompatible despu\u00e9s de que XDP ya est\u00e9 cargado -- se dej\u00f3 sin protecci\u00f3n en bond_option_xmit_hash_policy_set().\n\nNota:\nEl commit 094ee6017ea0 (\u0027bonding: verificar programa xdp al establecer modo de bond\u0027) a\u00f1adi\u00f3 posteriormente una protecci\u00f3n similar a bond_option_mode_set(), pero bond_option_xmit_hash_policy_set() permaneci\u00f3 sin protecci\u00f3n."
          }
        ],
        "id": "CVE-2026-23310",
        "lastModified": "2026-06-19T13:16:25.320",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-03-25T11:16:27.160",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0a80e6ecaf669c77260b44254f4a84d76bf83e89"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0ace8027e41f6f094ef6c1aca42d2ed6cd7af54e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/479d589b40b836442bbdadc3fdb37f001bb67f26"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5c262bd0e39320a6d6c8277cb8349ce21c01b8c1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d36ad7e126c6a0c5f699583309ccc37e3a3263ea"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e85fa809e507b9d8eff4840888b8c727e4e8448c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T07:20:04+00:00",
      "cve": "CVE-2026-23310",
      "id": "CVE-2026-23310",
      "initial_release_date": "2026-03-25T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23310.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-06-20T02:34:16Z",
      "cve": "CVE-2026-23310",
      "id": "CVE-2026-23310",
      "initial_release_date": "2026-03-25T16:56:41Z",
      "product_status:known_affected": "119",
      "product_status:known_not_affected": "198",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23310",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23310.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.