Executive brief
The Linux kernel's bridge networking component has a flaw in how it validates VLAN tunnel configuration ranges. When misconfigured with descending ID ranges, the validation code could produce unpredictable return values due to an uninitialized variable, potentially causing network configuration operations to behave unexpectedly or fail.
Technical details
A vulnerability exists in the bridge VLAN tunnel range processing logic (br_netlink_tunnel.c) where descending VLAN and tunnel IDs could pass validation due to integer signedness confusion. When a negative VLAN ID subtraction is converted to unsigned and compared against a u32 tunnel ID subtraction, wraparound can cause the span check to incorrectly pass. This results in a zero-iteration range loop that leaves the error variable uninitialized, causing unpredictable return values. The fix adds an explicit check to reject descending VLAN ranges (tinfo_curr->vid < tinfo_last->vid) before the span comparison. This is a local issue requiring network configuration privileges, and patches are available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel multiple versions (see stable tree branches)
Timeline
- 2026-09-17: disclosed
- 2026-08-14: patched: Fix committed upstream; backported to stable branches