Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause a system crash (kernel panic). This occurs when a network bridge port is removed or reconfigured while the system is processing certain types of network traffic. This issue primarily impacts system availability and could lead to a denial-of-service condition for servers or networking equipment running affected versions of Linux.
Technical details
A vulnerability exists in the Linux kernel netfilter subsystem due to a missing NULL check in ebt_redirect_tg(). The function dereferences the return value of br_port_get_rcu() without validation. If a bridge port is removed or moved to a different virtual device (like macvlan) between the initial hook invocation and an NFQUEUE reinject, the kernel attempts to access invalid memory, resulting in a panic. The fix involves switching to the netdev_master_upper_dev_get_rcu API to properly revalidate bridge ports before dereferencing. This affects systems using bridge netfilter (ebtables) and NFQUEUE.
Affected products
- Linux Linux 2.6.36 to 7.1
Timeline
- 2026-06-02: other: Patch authored
- 2026-06-25: disclosed: CVE published