CVE-2026-97436

Received Received - Intake

Memory Corruption in Linux Kernel dpaa2-switch

Publication date: 2026-09-24

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: rework FDB management on the bridge leave path On bridge leave, the dpaa2_switch_port_set_fdb() function always allocates a new FDB for the port which is becoming standalone. In case no FDB is found, then the port leaving a bridge will continue to use the current one. The above logic does not cover the case in which there are multiple bridges which have ports from the same DPSW instance. In this case, when the last port leaves bridge #1, it finds an unused FDB to switch to, but the old FDB is not marked as unused. Since the number of FDBs is equal to the number of DPSW interfaces, this will eventually lead to multiple ports sharing the same FDB. Fix this by changing how we are managing the FDBs on the leave path. Instead of directly allocating a new FDB, first verify if the current port is the last one to leave a bridge. If this is the case, then continue to use the current FDB and only allocate another FDB if there are other ports remaining in the bridge.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-97436

EUVD

EUVD-2026-86049

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect Forwarding Database (FDB) management in the dpaa2-switch driver. When a port leaves a bridge, the system fails to properly handle FDB allocation, leading to multiple ports sharing the same FDB. This happens because the old FDB is not marked unused when a port leaves, causing resource exhaustion as FDBs are limited by the number of DPSW interfaces.

Detection Guidance

This vulnerability is specific to the Linux kernel's dpaa2-switch driver and involves improper FDB (Forwarding Database) management during bridge leave operations. Detection requires checking kernel logs for bridge-related errors or examining the dpaa2-switch driver behavior. Commands like 'dmesg | grep dpaa2' or 'journalctl -k | grep bridge' may help identify issues. Ensure your kernel version includes the fix for this CVE.

Impact Analysis

This vulnerability could cause network traffic issues, such as misrouted packets or connectivity failures, due to shared FDB entries among ports. Systems using the dpaa2-switch driver with multiple bridges may experience instability or incorrect forwarding behavior.

Compliance Impact

This vulnerability affects network bridge management in the Linux kernel, which could lead to improper network traffic isolation. While not directly impacting GDPR or HIPAA compliance, it may indirectly affect data protection measures by allowing unauthorized network access between systems handling sensitive data.

Mitigation Strategies

Update the Linux kernel to the patched version that includes the fix for the dpaa2-switch FDB management issue. Monitor bridge leave operations to ensure FDBs are correctly managed when ports leave bridges.

Hi! I’m here to help you understand CVE-2026-97436. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70