SB2026092513 - Improper control of a resource through its lifetime in Linux kernel freescale dpaa2 driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-97436)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause multiple ports to share a forwarding database.

The vulnerability exists due to improper forwarding database state management in dpaa2_switch_port_set_fdb() when a port leaves a bridge while other ports continue to use the same forwarding database. A local privileged user can change bridge membership to cause multiple ports to share a forwarding database.

The issue occurs when multiple bridges have ports from the same DPSW instance.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/5adbc4d02d7df8bd7aa02c21874f7a582a576b55
• https://git.kernel.org/stable/c/abea361a11e4e48695ea149652ef5d3f308b6a49
• https://git.kernel.org/stable/c/efc1d92eacf03afa6f4d53bf7120e059b6f961f2