CVE-2026-97615
Description
A flaw was found in the Linux kernel's network bridge subsystem, which can lead to a Denial of Service (DoS) due to list corruption. When Connectivity Fault Management (CFM) or Media Redundancy Protocol (MRP) handlers are enabled across multiple network bridges, a shared data structure is improperly linked into multiple bridge lists. A local privileged user unregistering the protocol on one bridge can corrupt the active state of another bridge, resulting in a kernel crash.
Statement
A low impact vulnerability was found in the Linux kernel's network bridge subsystem. When Connectivity Fault Management (CFM) or Media Redundancy Protocol (MRP) is enabled on multiple bridge devices, a shared frame-handler data structure is linked into each bridge's frame handler list. Unregistering the protocol on one bridge then corrupts the list state belonging to another bridge, which can result in a kernel crash and a local denial of service. Exploiting this flaw requires local access with the privileges needed to configure network bridges (CAP_NET_ADMIN), and it affects availability only, with no impact on confidentiality or integrity.
The kernel packages in Red Hat Enterprise Linux 8, 9, and 10 (including kernel-rt), RHIVOS 2, and the RHEL CoreOS kernels shipped with OpenShift 4 are affected, with the fix deferred to a future update: the upstream solution reworks the bridge frame-handler registration mechanism (replacing the shared handler list with per-bridge option bits) rather than applying a minimal change, and the flaw's low security impact does not justify an expedited update. The residual risk is a local denial of service limited to systems where the uncommon CFM or MRP protocols are enabled across multiple bridge devices. Red Hat Enterprise Linux 7 (kernel and kernel-rt) and Red Hat Enterprise Linux 8.4 are not affected because the vulnerable code is not present in those streams. Although the CVSS:3.1 base score is 5.5 (Moderate), Red Hat rates the impact of this flaw as Low because exploitation requires local privileged access and only availability is affected.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Other
Technical Impact: Reduce Maintainability; Increase Analytical Complexity
This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
