Executive brief
A vulnerability in the Linux kernel's network bridging component can cause the entire system to crash. This occurs when specific network settings related to virtual networks (VLANs) are adjusted on a system where certain filtering features are disabled. An attacker with local access could exploit this to disrupt operations and cause a denial-of-service.
Technical details
A NULL pointer dereference exists in the Linux kernel bridge driver within the br_fdb_delete_locals_per_vlan_port and br_fdb_insert_locals_per_vlan_port functions. When CONFIG_BRIDGE_VLAN_FILTERING is disabled, the vlan group pointer (vg) returns NULL, but the BR_BOOLOPT_FDB_LOCAL_VLAN_0 toggle code attempts to dereference it during list iteration. This can be triggered by a local user via RTM_NEWLINK netlink messages when creating or modifying a bridge. The vulnerability results in a general protection fault and kernel oops. Patches have been released for various stable branches to add necessary NULL checks.
Affected products
- Linux Linux Kernel 6.18 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-03: patched: Initial fix committed to mainline kernel.
- 2026-05-06: disclosed: Vulnerability disclosed and CVE assigned.