CVE-2026-98285
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: vlan: fix bugs caused by switchdev deletion errors
Allowing switchdev to prevent vlan deletion and error out in __vlan_del could cause multiple different issues - inconsistent state, memory leaks when flushing, NULL pointer dereference on bridge error when flushing. It doesn't make sense to allow it to stop __vlan_del, so log the error and continue with software vlan deletion. This is also consistent with 8021q behaviour.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel networking subsystem contains a critical flaw within the Virtual Local Area Network (VLAN) management logic specifically related to switchdev operations. The vulnerability arises from an overly rigid error handling mechanism in the __vlan_del function, which is responsible for removing VLAN configurations from network bridges. When a hardware offload device represented by switchdev fails to delete a VLAN entry due to driver-specific constraints or internal errors, the current implementation allows this failure to abort the entire deletion process. This behavior creates a significant inconsistency between the software state maintained by the kernel and the actual configuration of the underlying hardware switching fabric. The core issue is that the system treats a partial failure in hardware offloading as a total failure of the administrative command, leaving the network bridge in an undefined or inconsistent state where the VLAN appears to be deleted from the operating system perspective but remains active on the physical switch ports.
This architectural flaw leads to several severe operational impacts for system administrators and automated orchestration tools. First, it results in memory leaks during subsequent flushing operations because resources allocated for the VLAN are not properly released when the deletion process is interrupted by a hardware error. Second, and more critically, it can trigger NULL pointer dereferences within the bridge code path when attempting to flush or manage interfaces that were expected to be fully cleaned up but retain residual references due to the aborted operation. These crashes can lead to kernel panics or network stack instability, effectively causing denial of service conditions for any services relying on stable networking connectivity. The inconsistency also complicates troubleshooting and automated recovery processes since tools may believe a VLAN is removed while it continues to forward traffic, potentially leading to security policy violations where restricted segments remain accessible.
From a vulnerability classification perspective, this issue aligns with CWE-401 Missing Release of Resource after Effective Lifetime, as the failure to complete deletion prevents proper cleanup of allocated structures. It also relates to CWE-823 Use of Out-of-range Pointer Offset or NULL Pointer Dereference due to the potential for accessing invalid memory states during error handling paths. In terms of attack surface and behavior mapping under MITRE ATT&CK techniques, this flaw could be leveraged in a Denial of Service context by an attacker with local access who can trigger specific switchdev deletion sequences that are known to fail on certain hardware configurations. By repeatedly inducing these inconsistent states or triggering the resulting NULL pointer dereferences, an adversary could destabilize the host system without needing elevated privileges beyond those required for network configuration changes.
The resolution involves modifying the error handling logic within __vlan_del to decouple software state management from hardware offload success. Instead of aborting the deletion upon encountering a switchdev error, the kernel now logs the failure and proceeds with the software-side VLAN removal. This approach ensures that the operating system's view of network configuration remains consistent regardless of the underlying hardware's ability to offload specific operations. By continuing with software vlan deletion, the system maintains proper resource accounting and prevents the accumulation of stale references that lead to memory leaks or crashes. This change also aligns the bridge VLAN behavior with standard 8021q expectations, ensuring predictable outcomes for network management tools regardless of whether hardware acceleration is available or functional.
To mitigate this vulnerability in environments where patching may not be immediately feasible, administrators should monitor kernel logs for switchdev deletion errors and verify that VLAN configurations are fully removed from both the software bridge and the physical switch ports using external monitoring tools. Regular audits of network interface states can help detect inconsistencies early before they lead to system instability. Furthermore, ensuring that all Linux kernels in production environments are updated to versions containing this fix is essential for maintaining network reliability and preventing potential denial-of-service conditions caused by resource exhaustion or kernel crashes triggered by malformed switchdev interaction sequences.