Live › vulnerability › CVE-2026-98966
Go to dashboardWhen an XDP program on a Linux bonding device is replaced or removed, the kernel fails to release the reference to the old BPF program. Leaked programs accumulate in memory over repeated attachments.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
bonding: fix the program leak when XDP is replaced
We need to release the reference on the old BPF prog, whether we are going to no-prog, or replacing the prog with another.
Spotted by AI while running tests for the propagation series (leaked programs were accumulating). Selftest will come in the net-next series to avoid conflicts.
This page as .md · .json · in your agent: get_signal("CVE-2026-98966")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.