CVE-2026-23212

In the Linux kernel, the following vulnerability has been resolved:

bonding: annotate data-races around slave->last_rx

slave->lastrx and slave->targetlastarprx[...] can be read and written locklessly. Add READONCE() and WRITEONCE() annotations.

syzbot reported:

BUG: KCSAN: data-race in bondrcvvalidate / bondrcvvalidate

write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1: bondrcvvalidate+0x202/0x7a0 drivers/net/bonding/bondmain.c:3335 bondhandleframe+0xde/0x5e0 drivers/net/bonding/bondmain.c:1533 __netifreceiveskb_core+0x5b1/0x1950 net/core/dev.c:6039 __netifreceiveskbonecore net/core/dev.c:6150 [inline] _netifreceiveskb+0x59/0x270 net/core/dev.c:6265 netifreceiveskbinternal net/core/dev.c:6351 [inline] netifreceiveskb+0x4b/0x2d0 net/core/dev.c:6410 ...

write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 0: bondrcvvalidate+0x202/0x7a0 drivers/net/bonding/bondmain.c:3335 bondhandleframe+0xde/0x5e0 drivers/net/bonding/bondmain.c:1533 __netifreceiveskb_core+0x5b1/0x1950 net/core/dev.c:6039 __netifreceiveskbonecore net/core/dev.c:6150 [inline] __netifreceiveskb+0x59/0x270 net/core/dev.c:6265 netifreceiveskbinternal net/core/dev.c:6351 [inline] netifreceiveskb+0x4b/0x2d0 net/core/dev.c:6410 brnetifreceiveskb net/bridge/brinput.c:30 [inline] NFHOOK include/linux/netfilter.h:318 [inline] ...

value changed: 0x0000000100005365 -> 0x0000000100005366