All vulnerabilities
CVE-2026-97615

Linux: net: bridge: use option bits for CFM/MRP frame handlers

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in260f99b355a44f6ce67971ebc9223b22c8f93957Also 994fd705ca498223d188024cde833739a9dddbd2, 42e033c8f30fd2923ccac3373ae70797e521dae1 and 1 moreCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 260f99b355a44f6ce67971ebc9223b22c8f93957LinuxCVE List
  • 994fd705ca498223d188024cde833739a9dddbd2LinuxCVE List
  • 42e033c8f30fd2923ccac3373ae70797e521dae1LinuxCVE List
  • 7a49e6b16f36b8e085521699adbca3e321b6dd0cLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: use option bits for CFM/MRP frame handlers

CFM and MRP register a global br_frame_type whose hlist_node is linked into the per-bridge frame_type_list when the first MEP/MRP instance is created. Enabling the protocol on multiple bridges therefore inserts the same node into multiple lists. Unregistering it on one bridge then corrupts list state belonging to another.

These handlers can only be installed once per bridge, and they are uncommon. Track their per-bridge enable state with net_bridge option bits, which already live on the Rx hot cache line, and dispatch the matching handler directly from the receive path. Check both bits together first as an unlikely case.

Remove the generic frame_type_list and br_frame_type helpers, which have had no other users since CFM and MRP were added. That shrinks struct net_bridge by 8 bytes and drops the list walk from the fast path. When neither protocol is compiled in, BR_CFM_MRP_OPTS is 0 and the compiler prunes the branch.

Text from CVE List

Affected versions 12

  • Linuxaffected: 90c628dd47ff4178f645b34938470bf43d02d123 before 260f99b355a44f6ce67971ebc9223b22c8f93957CVE List
  • Linuxaffected: 90c628dd47ff4178f645b34938470bf43d02d123 before be5ead6552418d70df3a76b962ccd6ed78a31fb5CVE List
  • Linuxaffected: 90c628dd47ff4178f645b34938470bf43d02d123 before 994fd705ca498223d188024cde833739a9dddbd2CVE List
  • Linuxaffected: 90c628dd47ff4178f645b34938470bf43d02d123 before 42e033c8f30fd2923ccac3373ae70797e521dae1CVE List
  • Linuxaffected: 90c628dd47ff4178f645b34938470bf43d02d123 before 7a49e6b16f36b8e085521699adbca3e321b6dd0cCVE List
  • Linuxaffected: 5.11CVE List
  • Linuxunaffected: all versions before 5.11CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5