---
id: CVE-2026-98966
title: 'bonding: fix the program leak when XDP is replaced'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bonding: fix the program leak when XDP is replaced

  We need to release the reference on the old BPF prog, whether
  we are going to no-prog, or replacing the prog with an…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e <
    bba6b1b086f9f4ddbfdaba7ea6279dc3abec70c7
  - >-
    Linux >= 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e <
    184b5ddf82d45d6f75cc83719a2e453392512bd2
  - Linux 5.15
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:19:36.024Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98966'
references:
  - url: 'https://git.kernel.org/stable/c/bba6b1b086f9f4ddbfdaba7ea6279dc3abec70c7'
  - url: 'https://git.kernel.org/stable/c/184b5ddf82d45d6f75cc83719a2e453392512bd2'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.553Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bonding: fix the program leak when XDP is replaced

We need to release the reference on the old BPF prog, whether
we are going to no-prog, or replacing the prog with another.

Spotted by AI while running tests for the propagation series
(leaked programs were accumulating). Selftest will come in
the net-next series to avoid conflicts.

## Affected

- `Linux >= 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e < bba6b1b086f9f4ddbfdaba7ea6279dc3abec70c7`
- `Linux >= 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e < 184b5ddf82d45d6f75cc83719a2e453392512bd2`
- `Linux 5.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.