SB2026102446 - Resource exhaustion in Linux kernel bridge
Published: October 24, 2026
Security Bulletin ID
SB2026102446
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Partial DoS
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Resource exhaustion (CVE-ID: CVE-2026-98881)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service by prolonging the blocking of network configuration operations.
The vulnerability exists due to excessive synchronization waits in the Linux kernel br_multicast_dev_del() function when tearing down bridge devices. A local user can trigger bridge device teardown to cause excessive RTNL lock contention through a stale rcu_barrier() call, delaying other network operations.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/0443f6aac6bf6a91e406273fdda11497cef6ad07
- https://git.kernel.org/stable/c/25ae123db10ba9ab890b56bcdb0a4363aee8529a
- https://git.kernel.org/stable/c/35f9f11740515a10b084adfb1ce691351f2452ab
- https://git.kernel.org/stable/c/372ee8fbe0f796031c60f676ec90f0788c26523d
- https://git.kernel.org/stable/c/39679927fa7aaf4601119f7234342d1b5d4f6f84
- https://git.kernel.org/stable/c/ac0e823a228f94ad9d7a3d876cc07e59a7afb806
- https://git.kernel.org/stable/c/f0018acf0b66f93a292667c9a9c2a26c570cf270