CVE-2026-98285

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: bridge: vlan: fix bugs caused by switchdev deletion errors Allowing switchdev to prevent vlan deletion and error out in __vlan_del could cause multiple different issues - inconsistent state, memory leaks when flushing, NULL pointer dereference on bridge error when flushing. It doesn't make sense to allow it to stop __vlan_del, so log the error and continue with software vlan deletion. This is also consistent with 8021q behaviour.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98285

EUVD

EUVD-2026-93213

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	bf361ad38165939049a2649b1a0078f3268d4bd1
Linux	Linux	bf361ad38165939049a2649b1a0078f3268d4bd1
Linux	Linux	4.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a bug in the bridge VLAN handling where switchdev errors could prevent proper VLAN deletion. This leads to inconsistent state, memory leaks during flushing, and potential NULL pointer dereferences when errors occur during bridge operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's bridge vlan handling. Detection involves checking kernel logs for errors related to vlan deletion or bridge operations. Use commands like 'dmesg | grep -i vlan' or 'journalctl -k | grep -i vlan' to search for relevant errors. If errors are found, verify the kernel version and apply patches if necessary.

Impact Analysis

If exploited, this flaw could cause system instability, crashes, or resource exhaustion due to memory leaks. Network bridges relying on VLANs may malfunction, leading to connectivity issues or security gaps in network segmentation.

Compliance Impact

This vulnerability affects network state consistency and memory management in the Linux kernel's bridge vlan functionality. It could lead to inconsistent network state, memory leaks during flushing operations, and NULL pointer dereferences, which may disrupt data integrity and availability. Such issues could potentially impact compliance with standards requiring data integrity and secure network operations, though specific regulatory impacts depend on system configuration and deployment.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel logs for bridge vlan deletion errors to identify affected systems.

Hi! I’m here to help you understand CVE-2026-98285. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70