CVE-2026-53337
In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix NULL pointer dereference in bond_do_ioctl() In bond_do_ioctl(), slave_dev is obtained via __dev_get_by_name() which can return NULL if the requested interface name does not exist. However, the subsequent slave_dbg() call is placed before the NULL check: slave_dev = __dev_get_by_name(net, ifr->ifr_slave); slave_dbg(bond_dev, slave_dev, "slave_dev=%p:\n", slave_dev); //here if (!slave_dev) return -ENODEV; The slave_dbg() macro expands to netdev_dbg(bond_dev, "(slave %s): " fmt, (slave_dev)->name, ...) which unconditionally dereferences slave_dev->name before the NULL check is performed. This results in a NULL pointer dereference kernel oops when a user calls bonding ioctl (e.g. SIOCBONDENSLAVE, SIOCBONDRELEASE, etc.) with a non-existent slave interface name. This is reachable from userspace via the bonding ioctl interface with CAP_NET_ADMIN capability, making it a potential local denial-of-service vector. Fix by moving the slave_dbg() call after the NULL check.
Affected versions
Linux kernel versions
5.3
and later are affected. Fixed in
5.10.259,
5.15.210,
6.1.176,
6.6.143,
6.12.94,
6.18.36,
7.0.13,
7.1
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-53337?
CVE-2026-53337 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.3 onward and has been patched in 5.10.259, 5.15.210, 6.1.176 and others. CVE-2026-53337 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-53337?
Yes — CVE-2026-53337 has been patched. Fixed versions include 5.10.259, 5.15.210, 6.1.176 and others. If you are running Linux kernel 5.3 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-53337 actively exploited?
No — CVE-2026-53337 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.