CVE-2026-43100: bridge: guard local VLAN-0 FDB helpers against NULL vlan group
In the Linux kernel, the following vulnerability has been resolved:
bridge: guard local VLAN-0 FDB helpers against NULL vlan group
When CONFIGBRIDGEVLANFILTERING is not set, brvlangroup() and nbpvlangroup() return NULL (brprivate.h stub definitions). The BRBOOLOPTFDBLOCALVLAN0 toggle code is compiled unconditionally and reaches brfdbdeletelocalspervlanport() and brfdbinsertlocalspervlanport(), where the NULL vlan group pointer is dereferenced via listforeachentry(v, &vg->vlanlist, vlist).
The observed crash is in the delete path, triggered when creating a bridge with IFLABRMULTIBOOLOPT containing BRBOOLOPTFDBLOCALVLAN0 via RTMNEWLINK. The insert helper has the same bug pattern.
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] KASAN NOPTI KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7] RIP: 0010:brfdbdeletelocalspervlan+0x2b9/0x310 Call Trace: brfdbtogglelocalvlan0+0x452/0x4c0 brtogglefdblocalvlan0+0x31/0x80 net/bridge/br.c:276 brboolopttoggle net/bridge/br.c:313 brbooloptmultitoggle net/bridge/br.c:364 brchangelink net/bridge/brnetlink.c:1542 brdevnewlink net/bridge/brnetlink.c:1575
Add NULL checks for the vlan group pointer in both helpers, returning early when there are no VLANs to iterate. This matches the existing pattern used by other bridge FDB functions such as brfdbadd() and brfdbdelete().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 7.0.0-1006.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.14-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Compensating control
Add NULL checks for the VLAN group pointer in both local VLAN-0 FDB helpers—br_fdb_delete_locals_per_vlan_port() and br_fdb_insert_locals_per_vlan_port()—returning early when there are no VLANs to iterate.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43100?
CVE-2026-43100 has been categorized as a medium severity vulnerability.
How do I fix CVE-2026-43100?
To fix CVE-2026-43100, ensure that CONFIG_BRIDGE_VLAN_FILTERING is set appropriately in the Linux kernel configuration.
What does CVE-2026-43100 affect?
CVE-2026-43100 affects the Linux kernel and specifically relates to bridge VLAN filtering.
What is the potential impact of CVE-2026-43100?
The potential impact of CVE-2026-43100 is related to the handling of VLANs, which may lead to improper access controls.
Is CVE-2026-43100 a remote or local vulnerability?
CVE-2026-43100 is primarily a local vulnerability that requires access to the system to exploit.