A public exploit now exists for CVE-2026-31419, a race condition in the Linux kernel’s network bonding driver that lets a local attacker gain root and escape a container. The code and write-up sit in Google’s security-research kernelCTF repository, and no exploitation in the wild has been confirmed.
Race Condition in bond_xmit_broadcast Behind CVE-2026-31419
The flaw carries a CVSS score of 7.8 and is classed as a race condition under CWE-362. It sits in drivers/net/bonding/bond_main.c, in the bond_xmit_broadcast path. In broadcast mode, the kernel clones the socket buffer for the earlier slave devices and reuses the original buffer for the last one. That handling creates a window in which concurrent operations can collide.
How Socket Buffer Reuse Opens the Race Window
Cloning the buffer for all but the last device avoids an extra copy, but it means the final device works on the original structure. A race over that shared handling is what the exploit abuses. The available reporting does not detail the exploitation steps beyond the root cause.
kernelCTF Exploit Demonstrates Root and Container Escape on Container-Optimized OS
Researchers built the exploit for Google’s kernelCTF program and tested it against Container-Optimized OS. They demonstrated full root access and a container escape, the two outcomes that matter most on shared infrastructure. The exploit and write-up were published in Google’s security-research kernelCTF repository.
Coverage of the release appeared on November 2. The exact publication date of the proof-of-concept is unverified in the available reporting.
Unprivileged User Namespaces Raise Exposure on Multi-Tenant Hosts
A local attacker can escalate to root, and the risk is highest where unprivileged user namespaces are enabled by default. Multi-tenant servers and container hosts commonly fall into that category, since they run workloads from users who should not hold elevated privileges. On such hosts, a process inside a container that reaches the vulnerable code could break out to the underlying machine.
Patch Guidance and the Local Attack Limits of CVE-2026-31419
Because the attacker must already have local access, the flaw is not a remote entry point. Its value lies in turning a low-privilege foothold, such as a compromised container workload, into control of the host. No in-the-wild exploitation is confirmed, but a published, working exploit shortens the time between an attacker obtaining a foothold and obtaining root.
The recommended action is to apply upstream kernel updates. Operators of container platforms and multi-tenant Linux hosts are the group most affected, because they depend on kernel isolation between workloads. The report comes from a single outlet, so details about specific affected kernel versions and distribution patch status are not available and will need to be checked against vendor advisories.
Google’s kernelCTF is a vulnerability-research program in which participants build working kernel exploits, and Container-Optimized OS is the Google-maintained operating system used to run containers. A full chain on that platform shows the flaw is exploitable on a system designed to limit this kind of risk. The CVSS 7.8 score reflects the local attack vector, even though the demonstrated result is complete root control.
The bond_xmit_broadcast function is part of the kernel’s network bonding driver, which combines multiple network interfaces into one logical link. The race arises because the code treats the last device differently from the earlier ones, cloning the socket buffer for the first group and reusing the original for the final one. The reporting identifies that asymmetry as the root of the race condition and classes the flaw under CWE-362.
No in-the-wild exploitation is confirmed, and the fix path is upstream kernel updates. Because the exploit and write-up are in a public repository, defenders can read the technique themselves when building detections or assessing their own container hosts.
