Subject: Re: [PATCHv2 net] bonding: alb: fix UAF in rlb_arp_recv during bond up/down

From: Jakub Kicinski <[email-masked]>
Date: Tue, 17 Feb 2026 16:43:55 -0800

On Sat, 14 Feb 2026 09:15:41 +0000 Hangbin Liu wrote:
> Fixes: e53665c6eaa6 ("bonding: delete migrated IP addresses from the rlb hash table")

Ah, also AI says the issue existed already in 
3aba891dde38 ("bonding: move processing of recv handlers into
handle_frame()")
not the exact trapping instruction but the hash table was used from
recv_probe so at least a UAF would happen.