Improper control of a resource through its lifetime in Linux kernel - CVE-2026-97436

Vulnerability details

The vulnerability allows a local privileged user to cause multiple ports to share a forwarding database.

The vulnerability exists due to improper forwarding database state management in dpaa2_switch_port_set_fdb() when a port leaves a bridge while other ports continue to use the same forwarding database. A local privileged user can change bridge membership to cause multiple ports to share a forwarding database.

The issue occurs when multiple bridges have ports from the same DPSW instance.

Affected software

How to mitigate CVE-2026-97436

External References

• https://git.kernel.org/stable/c/5adbc4d02d7df8bd7aa02c21874f7a582a576b55
• https://git.kernel.org/stable/c/abea361a11e4e48695ea149652ef5d3f308b6a49
• https://git.kernel.org/stable/c/efc1d92eacf03afa6f4d53bf7120e059b6f961f2

Related Security Bulletins

• Improper control of a resource through its lifetime in Linux kernel freescale dpaa2 driver