CVE-2026-98301 (GCVE-0-2026-98301)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:17
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: move switchdev call outside rcu This is a follow-up of one of sashiko's pre-existing bug reports. br_mst_set_state() calls switchdev_port_attr_set() for nonzero MSTIs while holding rcu_read_lock() which invokes the blocking switchdev notifier chain and may sleep. Nonzero MSTI changes come from netlink with rtnl held. Move the switchdev call before entering the rcu section and assert that rtnl is held. The call cannot be deferred because netlink needs its error and extack. Also DSA reads the old bridge MST state during the callback and checks it. A deferred callback will be late and will see the updated state.
References
Impacted products
Vendor Product Version
Linux Linux Version: 8ca9a750fc711911ef616ceb627d07357b04545e
Version: 4488617e5e995a09abe4d81add5fb165674edb59
Version: 3a7c1661ae1383364cd6092d851f5e5da64d476b
Version: 3a7c1661ae1383364cd6092d851f5e5da64d476b
Version: 3a7c1661ae1383364cd6092d851f5e5da64d476b
Version: 3a7c1661ae1383364cd6092d851f5e5da64d476b
Version: a2b01e65d9ba8af2bb086d3b7288ca53a07249ac
Version: e43dd2b1ec746e105b7db5f9ad6ef14685a615a4
Version: 6.1.93   ≤
Version: 6.6.33   ≤
Version: 6.8.12   ≤
Version: 6.9.3   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_mst.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b9661fd2423fc25e91e0517ecc0b6156ad83e3a8",
              "status": "affected",
              "version": "8ca9a750fc711911ef616ceb627d07357b04545e",
              "versionType": "git"
            },
            {
              "lessThan": "6b431b63219853eef4054e2f1cb073d2ca2059b4",
              "status": "affected",
              "version": "4488617e5e995a09abe4d81add5fb165674edb59",
              "versionType": "git"
            },
            {
              "lessThan": "abf734d150c61acfdfee102169d0e5d1c482e285",
              "status": "affected",
              "version": "3a7c1661ae1383364cd6092d851f5e5da64d476b",
              "versionType": "git"
            },
            {
              "lessThan": "d5c4ee1fa4e83a12afc051c831936cd8e006cde3",
              "status": "affected",
              "version": "3a7c1661ae1383364cd6092d851f5e5da64d476b",
              "versionType": "git"
            },
            {
              "lessThan": "c40ed3e884c8dc0350f26484030438ef24208ff1",
              "status": "affected",
              "version": "3a7c1661ae1383364cd6092d851f5e5da64d476b",
              "versionType": "git"
            },
            {
              "lessThan": "18a6fe05fb6e18de29fa90d388bb34044114b3d8",
              "status": "affected",
              "version": "3a7c1661ae1383364cd6092d851f5e5da64d476b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a2b01e65d9ba8af2bb086d3b7288ca53a07249ac",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e43dd2b1ec746e105b7db5f9ad6ef14685a615a4",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.189",
              "status": "affected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.158",
              "status": "affected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThan": "6.10",
              "status": "affected",
              "version": "6.9.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_mst.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "6.1.93",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "6.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.9.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mst: move switchdev call outside rcu\n\nThis is a follow-up of one of sashiko\u0027s pre-existing bug reports.\nbr_mst_set_state() calls switchdev_port_attr_set() for nonzero MSTIs\nwhile holding rcu_read_lock() which invokes the blocking switchdev\nnotifier chain and may sleep. Nonzero MSTI changes come from netlink\nwith rtnl held. Move the switchdev call before entering the rcu section and\nassert that rtnl is held.\n\nThe call cannot be deferred because netlink needs its error and extack.\nAlso DSA reads the old bridge MST state during the callback and checks it.\nA deferred callback will be late and will see the updated state."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:17:12.171Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b9661fd2423fc25e91e0517ecc0b6156ad83e3a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b431b63219853eef4054e2f1cb073d2ca2059b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/abf734d150c61acfdfee102169d0e5d1c482e285"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5c4ee1fa4e83a12afc051c831936cd8e006cde3"
        },
        {
          "url": "https://git.kernel.org/stable/c/c40ed3e884c8dc0350f26484030438ef24208ff1"
        },
        {
          "url": "https://git.kernel.org/stable/c/18a6fe05fb6e18de29fa90d388bb34044114b3d8"
        }
      ],
      "title": "net: bridge: mst: move switchdev call outside rcu",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98301",
    "datePublished": "2026-10-06T08:45:58.908Z",
    "dateReserved": "2026-09-25T10:25:14.337Z",
    "dateUpdated": "2026-10-19T09:17:12.171Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.