Verified — Linux kernel bonding can inherit header_ops from non‑Ethernet slaves (e.g., GRE), causing type confusion and kernel crashes when dev_hard_header() is invoked on the bond device.
Severity HIGH
Confidence HIGH
Reproduced in 64m 59s
Tool calls 347
Spend $10.02
Affected Mainline kernels 5.10 through 6.6 and stable releases without the backported fix (per third-party reports)
$
pruva-verify REPRO-2026-00211 or
curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00211/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Run in a VM or disposable container. This exploits a real vulnerability.
The Linux kernel bonding driver copies header_ops from a slave device to the bond device. If the slave is a non‑Ethernet device (e.g., GRE), the bond later calls dev_hard_header() with header_ops that expect the slave’s netdev_priv() layout, but receive the bond’s private data instead, leading to type confusion and kernel crashes.
Variant analysis
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.
bundle/ticket.md3.0 KBbundle/ticket.json4.1 KBbundle/AGENTS.repro.md0.2 KBbundle/repro/validation_verdict.json1.6 KBbundle/repro/runtime_manifest.json1.6 KBbundle/logs/qemu_vuln.log44.9 KBbundle/logs/qemu_vuln_mode1_single.log36.9 KBbundle/logs/qemu_vuln_ip6gre.log35.5 KBbundle/logs/qemu_vuln_ip6gre2.log36.3 KBbundle/logs/qemu_vuln_7rc2.log34.6 KBbundle/logs/qemu_fixed_7rc2.log36.2 KBbundle/logs/qemu_probe_7rc2.log27.1 KBbundle/logs/reproduction_steps.log16.9 KBbundle/logs/repro_run.out1.6 KBbundle/logs/repro_run2.out1.6 KBbundle/logs/qemu_var_vuln.log35.7 KBbundle/logs/qemu_var_fixed.log36.6 KBbundle/logs/vuln_variant_repro.log10.3 KBbundle/vuln_variant/populate_hlen6.c2.0 KBbundle/vuln_variant/bond_variant_init.c5.8 KBbundle/vuln_variant/bond_variant_init817.5 KBbundle/vuln_variant/build_and_boot.sh3.0 KBbundle/vuln_variant/validation_verdict.json3.0 KBbundle/vuln_variant/patch_analysis.md13.8 KBbundle/vuln_variant/source_identity.json2.7 KBbundle/vuln_variant/root_cause_equivalence.json4.0 KBbundle/vuln_variant/runtime_manifest.json4.2 KBbundle/vuln_variant/variant_manifest.json6.3 KBbundle/repro/reproduction_steps.sh29.6 KBbundle/repro/rca_report.md15.4 KBbundle/vuln_variant/reproduction_steps.sh20.0 KBbundle/vuln_variant/rca_report.md17.2 KB