CVE-2026-97615
Received Received - Intake

Linux Kernel Bridge CFM/MRP Frame Handler Use-After-Free

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: bridge: use option bits for CFM/MRP frame handlers CFM and MRP register a global br_frame_type whose hlist_node is linked into the per-bridge frame_type_list when the first MEP/MRP instance is created. Enabling the protocol on multiple bridges therefore inserts the same node into multiple lists. Unregistering it on one bridge then corrupts list state belonging to another. These handlers can only be installed once per bridge, and they are uncommon. Track their per-bridge enable state with net_bridge option bits, which already live on the Rx hot cache line, and dispatch the matching handler directly from the receive path. Check both bits together first as an unlikely case. Remove the generic frame_type_list and br_frame_type helpers, which have had no other users since CFM and MRP were added. That shrinks struct net_bridge by 8 bytes and drops the list walk from the fast path. When neither protocol is compiled in, BR_CFM_MRP_OPTS is 0 and the compiler prunes the branch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97615
EUVD
EUVD-2026-86746

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of CFM and MRP frame handlers in the bridge subsystem. When these protocols are enabled on multiple bridges, their shared handler node gets linked into multiple lists. Unregistering it on one bridge corrupts the list state of another bridge, potentially causing system instability or crashes.

Detection Guidance

This vulnerability affects the Linux kernel's bridge networking subsystem, specifically CFM and MRP frame handlers. Detection requires checking kernel logs for bridge-related errors or crashes. Use commands like 'dmesg | grep bridge' or 'journalctl -k | grep bridge' to inspect kernel logs for unusual bridge behavior. If CFM or MRP protocols are enabled, verify their configuration with 'brctl show' or 'ip link show'. No direct commands detect this issue, but monitoring bridge-related errors can indicate exploitation.

Impact Analysis

If exploited, this flaw could lead to kernel memory corruption, crashes, or denial of service on affected systems. It primarily affects systems using Linux kernel bridge networking with CFM or MRP protocols enabled, though these are uncommon configurations.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-97615. Disable CFM and MRP protocols if not in use by modifying bridge configurations. Monitor kernel logs for bridge-related errors post-update. If CFM or MRP are required, ensure they are configured correctly and avoid enabling them on multiple bridges simultaneously.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97615. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart