---
id: CVE-2026-23451
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bonding: prevent potential infinite loop in bond_header_parse()

  bond_header_parse() can loop if a stack of two bonding devices is setup,
  because skb->dev always points…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bonding: prevent potential infinite loop in bond_header_parse()

  bond_header_parse() can loop if a stack of two bonding devices is setup,
  because skb->dev always points…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-835
vendor: linux
product: linux_kernel
affected:
  - linux_kernel = 6.12.78
  - linux_kernel = 6.18.19
  - linux_kernel = 6.19.9
  - linux_kernel = 7.0
published: '2026-04-03'
updated: '2026-07-24'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23451'
references:
  - url: 'https://git.kernel.org/stable/c/4172a7901cf43fe1cc63ef7a2ef33735ff7b7d13'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/946bb6cacf0ccada7bc80f1cfa07c1ed79511c1c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9532d0d0ad1d726c06f807e8f0f1ec93cbabb452'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9b49c854f14f5e2d493e562a1e28d2e57fe37371'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b7405dcf7385445e10821777143f18c3ce20fa04'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00441
epssPercentile: 0.3773
ingestedAt: '2026-07-24T15:30:58.288Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bonding: prevent potential infinite loop in bond_header_parse()

bond_header_parse() can loop if a stack of two bonding devices is setup,
because skb->dev always points to the hierarchy top.

Add new "const struct net_device *dev" parameter to
(struct header_ops)->parse() method to make sure the recursion
is bounded, and that the final leaf parse method is called.

## Affected

- `linux_kernel = 6.12.78`
- `linux_kernel = 6.18.19`
- `linux_kernel = 6.19.9`
- `linux_kernel = 7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.