Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni [off-list ref]:

On Thu, 26 Mar 2026 00:55:53 -0700 you wrote:

bond_xmit_broadcast() reuses the original skb for the last slave
(determined by bond_is_last_slave()) and clones it for others.
Concurrent slave enslave/release can mutate the slave list during
RCU-protected iteration, changing which slave is "last" mid-loop.
This causes the original skb to be double-consumed (double-freed).

Replace the racy bond_is_last_slave() check with a simple index
comparison (i + 1 == slaves_count) against the pre-snapshot slave
count taken via READ_ONCE() before the loop.  This preserves the
zero-copy optimization for the last slave while making the "last"
determination stable against concurrent list mutations.

[...]

Here is the summary with links:
  - [net,v3] net: bonding: fix use-after-free in bond_xmit_broadcast()
    https://git.kernel.org/netdev/net/c/2884bf72fb8f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html