SB20260507263 - NULL pointer dereference in Linux kernel bridge

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-43100)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in bridge FDB local VLAN-0 helper functions when handling RTM_NEWLINK requests with IFLA_BR_MULTI_BOOLOPT containing BR_BOOLOPT_FDB_LOCAL_VLAN_0 while bridge VLAN filtering is not enabled. A local user can send a specially crafted netlink request to cause a denial of service.

The issue is triggered when CONFIG_BRIDGE_VLAN_FILTERING is not set.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1979645e1842cb7017525a61a0e0e0beb924d02a
• https://git.kernel.org/stable/c/ddf0ec2d600e7dad62b89692749534d7900a732a
• https://git.kernel.org/stable/c/fb612d436ff0317659e45a91c25fd7d9516f5b1b