{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-43100","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-05-01T14:12:55.984Z","datePublished":"2026-05-06T07:40:30.309Z","dateUpdated":"2026-05-11T22:17:43.866Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-05-11T22:17:43.866Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: guard local VLAN-0 FDB helpers against NULL vlan group\n\nWhen CONFIG_BRIDGE_VLAN_FILTERING is not set, br_vlan_group() and\nnbp_vlan_group() return NULL (br_private.h stub definitions). The\nBR_BOOLOPT_FDB_LOCAL_VLAN_0 toggle code is compiled unconditionally and\nreaches br_fdb_delete_locals_per_vlan_port() and\nbr_fdb_insert_locals_per_vlan_port(), where the NULL vlan group pointer\nis dereferenced via list_for_each_entry(v, &vg->vlan_list, vlist).\n\nThe observed crash is in the delete path, triggered when creating a\nbridge with IFLA_BR_MULTI_BOOLOPT containing BR_BOOLOPT_FDB_LOCAL_VLAN_0\nvia RTM_NEWLINK. The insert helper has the same bug pattern.\n\n  Oops: general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] KASAN NOPTI\n  KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7]\n  RIP: 0010:br_fdb_delete_locals_per_vlan+0x2b9/0x310\n  Call Trace:\n   br_fdb_toggle_local_vlan_0+0x452/0x4c0\n   br_toggle_fdb_local_vlan_0+0x31/0x80 net/bridge/br.c:276\n   br_boolopt_toggle net/bridge/br.c:313\n   br_boolopt_multi_toggle net/bridge/br.c:364\n   br_changelink net/bridge/br_netlink.c:1542\n   br_dev_newlink net/bridge/br_netlink.c:1575\n\nAdd NULL checks for the vlan group pointer in both helpers, returning\nearly when there are no VLANs to iterate. This matches the existing\npattern used by other bridge FDB functions such as br_fdb_add() and\nbr_fdb_delete()."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bridge/br_fdb.c"],"versions":[{"version":"21446c06b441b9c993870efae71aef4e9aa72ec7","lessThan":"fb612d436ff0317659e45a91c25fd7d9516f5b1b","status":"affected","versionType":"git"},{"version":"21446c06b441b9c993870efae71aef4e9aa72ec7","lessThan":"ddf0ec2d600e7dad62b89692749534d7900a732a","status":"affected","versionType":"git"},{"version":"21446c06b441b9c993870efae71aef4e9aa72ec7","lessThan":"1979645e1842cb7017525a61a0e0e0beb924d02a","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bridge/br_fdb.c"],"versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","status":"unaffected","versionType":"semver"},{"version":"6.18.24","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"6.19.14","lessThanOrEqual":"6.19.*","status":"unaffected","versionType":"semver"},{"version":"7.0","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"6.18.24"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"6.19.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.0"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/fb612d436ff0317659e45a91c25fd7d9516f5b1b"},{"url":"https://git.kernel.org/stable/c/ddf0ec2d600e7dad62b89692749534d7900a732a"},{"url":"https://git.kernel.org/stable/c/1979645e1842cb7017525a61a0e0e0beb924d02a"}],"title":"bridge: guard local VLAN-0 FDB helpers against NULL vlan group","x_generator":{"engine":"bippy-1.2.0"}}}}