CVE-2026-23212

In the Linux kernel, the following vulnerability has been resolved:

bonding: annotate data-races around slave->last_rx

slave->last_rx and slave->target_last_arp_rx[...] can be read and written

locklessly. Add READ_ONCE() and WRITE_ONCE() annotations.

syzbot reported:

BUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate

write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1:

bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335

bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533

__netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039

__netif_receive_skb_one_core net/core/dev.c:6150 [inline]

__netif_receive_skb+0x59/0x270 net/core/dev.c:6265

netif_receive_skb_internal net/core/dev.c:6351 [inline]

netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410

...

write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 0:

bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335

bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533

__netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039

__netif_receive_skb_one_core net/core/dev.c:6150 [inline]

__netif_receive_skb+0x59/0x270 net/core/dev.c:6265

netif_receive_skb_internal net/core/dev.c:6351 [inline]

netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410

br_netif_receive_skb net/bridge/br_input.c:30 [inline]

NF_HOOK include/linux/netfilter.h:318 [inline]

...

value changed: 0x0000000100005365 -> 0x0000000100005366