ROS by CVE-2026-31419 affected?

RouterOS General
1

Hi, is ROS affected by CVE-2026-31419?

  1. CVSS v3.1: 7,8
  2. Race Condition (CWE-362) Use-after-free in bond_xmit_broadcast()

There is a PoC now:

2

RouterOS 7’s kernel is 5.6.3 and the condition doesn’t apply to anything earlier than 5.17rc1. Unless MikroTik retrofitted the bonding driver from a later kernel, RouterOS should be unaffected.