Cloudanix VulnDB

CVE-2026-98285

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux networking could let certain hardware-assisted network setups cause crashes or memory problems when changing virtual network settings, potentially disrupting systems that rely on those features.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability allows switchdev errors during VLAN deletion in the Linux bridge to cause inconsistent internal state, memory leaks during flush operations, and NULL pointer dereferences when the bridge encounters errors.

Why it matters to the business

Network instability or kernel crashes on systems using bridge VLANs with switchdev hardware offload can lead to unplanned downtime, disrupted connectivity, and potential data loss in virtualized or containerized environments.

How an attack unfolds

An attacker with local access triggers VLAN deletion operations on a bridge interface configured with switchdev, causing the kernel to hit error paths that were previously allowed to abort deletion; this leads to leaked memory or dereference of invalid pointers during subsequent flush or error handling.

How to fix it

Update to a Linux kernel version containing the fix that logs switchdev deletion errors and continues with software VLAN deletion instead of allowing the error to abort the operation.

How to confirm the fix worked

Confirm the kernel source includes the change that removes the ability for switchdev to stop __vlan_del and instead logs the error while proceeding with deletion; test bridge VLAN flush operations under error conditions to verify absence of leaks or crashes.

Typical attack path

  1. Obtain local access on a Linux system using bridge networking with switchdev
  2. Configure or manipulate bridge VLANs to enable hardware offload
  3. Trigger repeated VLAN addition and deletion operations
  4. Force bridge flush or error conditions to expose the inconsistent state or NULL dereference

How to detect it

Search kernel logs for bridge VLAN deletion errors or NULL pointer dereference crashes involving __vlan_del or switchdev; inspect for unexpected memory growth in bridge-related processes during VLAN flush operations.

What your security team should do

  • Prioritize kernel updates on systems using bridge VLANs with switchdev offload
  • Monitor for bridge-related kernel panics or memory leak reports in affected environments
  • Review network configurations to identify unnecessary switchdev usage on bridges

The record

In the Linux kernel, the following vulnerability has been resolved: net: bridge: vlan: fix bugs caused by switchdev deletion errors Allowing switchdev to prevent vlan deletion and error out in __vlan_del could cause multiple different issues - inconsistent state, memory leaks when flushing, NULL pointer dereference on bridge error when flushing. It doesn't make sense to allow it to stop __vlan_del, so log the error and continue with software vlan deletion. This is also consistent with 8021q behaviour.

Affected packages

Ecosystem Package Introduced Fixed