Subject: Re: [PATCHv2 net] bonding: alb: fix UAF in rlb_arp_recv during bond up/down

From: Hangbin Liu <[email-masked]>
Date: Wed, 18 Feb 2026 04:36:24 +0000

On Tue, Feb 17, 2026 at 04:43:55PM -0800, Jakub Kicinski wrote:
> On Sat, 14 Feb 2026 09:15:41 +0000 Hangbin Liu wrote:
> > Fixes: e53665c6eaa6 ("bonding: delete migrated IP addresses from the rlb hash table")
> 
> Ah, also AI says the issue existed already in 
> 3aba891dde38 ("bonding: move processing of recv handlers into
> handle_frame()")
> not the exact trapping instruction but the hash table was used from
> recv_probe so at least a UAF would happen.

Not sure if I understand correctly. Do you mean we still able to access
rlb_arp_recv() after setting recv_probe to NULL?

OK, that also count as UAF, even though not crash would happen.

Thanks
Hangbin