CVE-2026-98285: net: bridge: vlan: fix bugs caused by switchdev deletion errors
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: vlan: fix bugs caused by switchdev deletion errors
Allowing switchdev to prevent vlan deletion and error out in vlandel could cause multiple different issues - inconsistent state, memory leaks when flushing, NULL pointer dereference on bridge error when flushing. It doesn't make sense to allow it to stop vlandel, so log the error and continue with software vlan deletion. This is also consistent with 8021q behaviour.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel bridge VLAN functionality with switchdev involvement are relevant. The failure condition occurs when switchdev prevents VLAN deletion and returns an error during __vlan_del.
What can happen when the vulnerable deletion path is triggered?
A switchdev deletion error can leave bridge VLAN state inconsistent and cause memory leaks during VLAN flushing. A bridge error while flushing can also lead to a NULL pointer dereference.
What does the fix change?
The fix logs switchdev deletion errors but continues the software VLAN deletion rather than allowing switchdev to stop __vlan_del. This avoids the inconsistent state, flushing leaks, and NULL dereference described for the error path.