CVE-2026-43441

Home/CVE/In the Linux kernel, the following vulnerability has been resolved: net: bonding: Fix nd_tbl NULL dereference when IPv6

CVE

In the Linux kernel, the following vulnerability has been resolved: net: bonding: Fix nd_tbl NULL dereference when IPv6

In the Linux kernel, the following vulnerability has been resolved: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which initializes it. If bonding ARP/NS validation is enabled, an IPv6 NS/NA packet received on a slave can reach bond_validate_na(), which calls bond_has_this_ip6(). That path calls ipv6_chk_addr() and can crash in __ipv6_chk_addr_and_flags().

BUG: kernel NULL pointer dereference, address: 00000000000005d8 Oops: 0000 [#1] SMP NOPTI RIP: 0010:__ipv6_chk_addr_and_flags+0x69/0x170 Call Trace: <IRQ> ipv6_chk_addr+0x1f/0x30 bond_validate_na+0x12e/0x1d0 [bonding] ? __pfx_bond_handle_frame+0x10/0x10 [bonding] bond_rcv_validate+0x1a0/0x450 [bonding] bond_handle_frame+0x5e/0x290 [bonding] ? srso_alias_return_thunk+0x5/0xfbef5 __netif_receive_skb_core.constprop.0+0x3e8/0xe50 ? srso_alias_return_thunk+0x5/0xfbef5 ? update_cfs_rq_load_avg+0x1a/0x240 ? srso_alias_return_thunk+0x5/0xfbef5 ? __enqueue_entity+0x5e/0x240 __netif_receive_skb_one_core+0x39/0xa0 process_backlog+0x9c/0x150 __napi_poll+0x30/0x200 ? srso_alias_return_thunk+0x5/0xfbef5 net_rx_action+0x338/0x3b0 handle_softirqs+0xc9/0x2a0 do_softirq+0x42/0x60 </IRQ> <TASK> __local_bh_enable_ip+0x62/0x70 __dev_queue_xmit+0x2d3/0x1000 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? packet_parse_headers+0x10a/0x1a0 packet_sendmsg+0x10da/0x1700 ? kick_pool+0x5f/0x140 ? srso_alias_return_thunk+0x5/0xfbef5 ? __queue_work+0x12d/0x4f0 __sys_sendto+0x1f3/0x220 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x101/0xf80 ? exc_page_fault+0x6e/0x170 ? srso_alias_return_thunk+0x5/0xfbef5 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Fix this by checking ipv6_mod_enabled() before dispatching IPv6 packets to bond_na_rcv(). If IPv6 is disabled, return early from bond_rcv_validate() and avoid the path to ipv6_chk_addr().

HIGH · CVSS 7.5 EPSS 0.00076

Schedule remediation

CVSS base score ≥ 7.0

Sigma rules0 YARA rules0

Look this up elsewhere - one-click external pivots

NVD CVE.org CISA Vulners Exploit-DB GitHub PoC VulnCheck KEV GreyNoise

▸ How to read a CVE - triage first, then detect and patch

This page is every public fact about CVE-2026-43441, cross-linked. Its job is to answer one question fast - does this need my attention now? - and then hand you the two things you do about it. Here is how an analyst reads it.

Triage: should I act now? Four signals, and they are not interchangeable:

CVSSseverity - how bad it is IF exploited, 0-10. A high CVSS alone is not urgency; a flaw can be a perfect 10 and never actually be attacked. EPSSprobability - a model’s estimate of the chance it is exploited in the next 30 days, 0-1. This is the “will it actually happen” signal. CISA KEVconfirmed - it is being exploited in the wild right now. The strongest signal on the page; KEV beats any score. Weaponisedavailability - public exploits / PoCs, and especially Metasploit modules rated Excellent / Great. Reliable, packaged exploit code means low-skill attackers can use it today.

How they combine: KEV, or a dependable Metasploit module, means patch now regardless of CVSS. High CVSS + low EPSS + no exploit is real but not an emergency - schedule it. Low CVSS but KEV-listed still gets patched now. The verdict above already weighed these for you; this is how it got there.

Then what - two workflows:

Detectwhen you cannot patch today, follow this CVE to the ATT&CK techniques it enables, then Build a SIEM detection (the green button) - author a rule, test it in Atomic, deploy it. That buys visibility while the patch waits. PatchAffected products / packages tell you if you are exposed; Fixed versions by distribution and Vendor advisories give the exact version that closes it.

Reading order for the panels below: verdict + badges, then Public exploits / Metasploit (is it weaponised), then ATT&CK techniques + Sigma / IDS rules (can I detect it), then Affected products / packages + Fixed versions (am I exposed, what patches it), then Threat actors / IOCs (who uses it), then Scoring & timeline / references (the evidence).

View attack path from CVE-2026-43441

◆

ATT&CK techniques

Techniques this CVE enables - linked via CWECAPECATT&CK. High◆ = named directly in ATT&CK or Nuclei templates.

T1190 · Exploit Public-Facing Application

▤ Build a SIEM detection for these techniques

⬡

Weakness Classification

CWE-476NULL Pointer Dereference

▤

Affected Products & Versions

linux kernel>= 5.18 and < 6.1.167
linux kernel>= 6.2 and < 6.6.130
linux kernel>= 6.7 and < 6.12.78
linux kernel>= 6.13 and < 6.18.19
linux kernel>= 6.19 and < 6.19.9
linux kernelall versions

📦

Fixed versions by distribution

The package version that resolves this CVE on each Linux distribution, from the vendor’s published security data. fixed in shows a patched version exists; open means the package is listed as affected with no fix yet.
suse sle15cluster-md-kmp-default open
suse sle15cluster-md-kmp-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15dlm-kmp-default open
suse sle15dlm-kmp-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15gfs2-kmp-default open
suse sle15gfs2-kmp-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15kernel-64kb fixed in 0:6.4.0-150700.53.55.1
suse sle15kernel-azure fixed in 0:6.4.0-150700.53.55.1
suse sle15kernel-default open
suse sle15kernel-default-base fixed in 0:6.4.0-150700.53.55.1.150700.17.33.1
suse sle15kernel-default-devel open
suse sle15kernel-default-extra fixed in 0:6.4.0-150700.53.55.1
suse sle15kernel-default-livepatch open
suse sle15kernel-default-livepatch-devel open
suse sle15kernel-default-man open
suse sle15kernel-devel open
suse sle15kernel-docs fixed in 0:6.4.0-150700.53.55.1
suse sle15kernel-livepatch-6_4_0-150700_7_54-rt fixed in 0:1-150700.1.3.1
suse sle15kernel-macros open
suse sle15kernel-obs-build fixed in 0:6.4.0-150700.53.55.1
suse sle15kernel-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15kernel-source fixed in 0:6.4.0-150700.53.55.1
suse sle15kernel-source-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15kernel-syms fixed in 0:6.4.0-150700.53.55.1
suse sle15kernel-syms-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15kernel-zfcpdump fixed in 0:6.4.0-150700.53.55.1
suse sle15ocfs2-kmp-default open
suse sle15ocfs2-kmp-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15reiserfs-kmp-default fixed in 0:6.4.0-150700.53.55.1

▣

Scoring & Timeline

7.5

HIGH · CVSS v3.1 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67

View on NVD

Attack Vector

Network Adjacent Local Physical

Attack Complexity

Low High

Privileges Required

None Low High

User Interaction

None Required

Scope

Unchanged Changed

Confidentiality

None Low High

Integrity

None Low High

Availability

None Low High

Published to NVD08 May 2026 · 03:16 PM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

⚑

Vendor Advisories

suse-csafSUSE-SU-2026:2238-1
suse-csafSUSE-SU-2026:2217-1
suse-csafSUSE-SU-2026:21876-1
suse-csafSUSE-SU-2026:21877-1
suse-csafSUSE-SU-2026:21916-1
Show all 10 vendor advisoriessuse-csafSUSE-SU-2026:21919-1
suse-csafopenSUSE-SU-2026:20826-1
suse-csafSUSE-SU-2026:21841-1
suse-csafSUSE-SU-2026:21845-1
suse-csafSUSE-SU-2026:21860-1

🔗

References & Sources

Source URLs (vendor pages, mailing lists, write-ups). Exploit/PoC links are in their own section above to avoid duplication.

https://git.kernel.org/stable/c/30021e969d48e5819d5ae56936c2f34c0f7ce997Patch

https://git.kernel.org/stable/c/49dbfcb70eca5f6f9043594e1e323c74c39e3863Patch

https://git.kernel.org/stable/c/95faa1459b83fa544191e82ccc73856f03b7741fPatch

https://git.kernel.org/stable/c/c78f01abe535853f13f0b26cd5b1d2f19bf52e2fPatch

https://git.kernel.org/stable/c/c9c238066fb254dabf65e27379f93c56112c5b96Patch

https://git.kernel.org/stable/c/cf6099ef493b94e140b0fad52482a78853115318Patch