CVE-2026-98301
Description
A flaw was found in the Linux kernel's network bridge subsystem. A local user with network configuration privileges can trigger a Denial of Service (DoS) by updating bridge Multiple Spanning Tree (MST) states. Because a blocking operation is invoked within an atomic execution context that cannot safely sleep, this flaw can cause kernel instability and crash the system.
Statement
br_mst_set_state can invoke the blocking switchdev notifier chain while holding rcu_read_lock. A notifier callback that sleeps can violate the RCU read side execution rules and may cause a sleeping while atomic warning, a prolonged stall, or a driver dependent deadlock. The trigger is a local netlink control plane operation that changes a nonzero MSTI state while RTNL is held. It is not directly reachable through ordinary remote packet traffic. For the CVSS the PR:L in the paranoid score reflects environments where CAP_NET_ADMIN is delegated to a network service, container root, or a user in a network namespace rather than requiring unrestricted host root. Impact is primarily denial of service. No UAF, OOB access, information leak, or write primitive is demonstrated by this patch.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity,Confidentiality,Other
Technical Impact: Modify Application Data; Read Application Data; Alter Execution Logic; Unexpected State
If access to a shared resource is not correctly synchronized, then the resource may not be in a state that is expected by the product. This might lead to unexpected or insecure behaviors, especially if an attacker can influence the shared resource.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
