Cloudanix VulnDB

CVE-2026-98301

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A locking error in the Linux kernel's network bridge handling could cause systems to crash when changing certain network settings.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Calling a potentially blocking switchdev notifier chain while holding an RCU read lock in br_mst_set_state for nonzero MSTIs, violating RCU constraints that prohibit sleeping.

Why it matters to the business

Could lead to kernel crashes or hangs on Linux systems using network bridges with Multiple Spanning Tree protocol, affecting network stability in servers and devices.

How an attack unfolds

An attacker with privileges to configure bridge MST states via netlink could trigger the blocking call under RCU lock, potentially causing a crash or deadlock; however, no known exploitation exists.

How to fix it

Update the Linux kernel to a version that includes the fix moving the switchdev call outside the RCU section.

How to confirm the fix worked

Verify the kernel source has the switchdev_port_attr_set call before the rcu_read_lock in br_mst_set_state and check for rtnl lock assertion.

Typical attack path

  1. Obtain privileges to send netlink messages for bridge configuration
  2. Configure nonzero MSTI state on a bridge port
  3. Trigger the switchdev notifier which attempts to sleep under RCU lock

How to detect it

Look for kernel oops or panic logs related to sleeping in atomic context or RCU violations during bridge configuration.

What your security team should do

  • Monitor for kernel updates addressing this bridge MST issue
  • Apply patches promptly on systems using MST bridges
  • Test network configurations in staging environments

The record

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: move switchdev call outside rcu This is a follow-up of one of sashiko's pre-existing bug reports. br_mst_set_state() calls switchdev_port_attr_set() for nonzero MSTIs while holding rcu_read_lock() which invokes the blocking switchdev notifier chain and may sleep. Nonzero MSTI changes come from netlink with rtnl held. Move the switchdev call before entering the rcu section and assert that rtnl is held. The call cannot be deferred because netlink needs its error and extack. Also DSA reads the old bridge MST state during the callback and checks it. A deferred callback will be late and will see the updated state.

Affected packages

Ecosystem Package Introduced Fixed