CVE-2026-98301

net: bridge: mst: move switchdev call outside rcu

Published Oct 6, 2026 CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mst: move switchdev call outside rcu

This is a follow-up of one of sashiko's pre-existing bug reports.
br_mst_set_state() calls switchdev_port_attr_set() for nonzero MSTIs
while holding rcu_read_lock() which invokes the blocking switchdev
notifier chain and may sleep. Nonzero MSTI changes come from netlink
with rtnl held. Move the switchdev call before entering the rcu section and
assert that rtnl is held.

The call cannot be deferred because netlink needs its error and extack.
Also DSA reads the old bridge MST state during the callback and checks it.
A deferred callback will be late and will see the updated state.

Analysis

Technical impact

The Linux kernel bridge MST module contains a flaw where the function that changes MST state calls a switchdev attribute function while an RCU read lock is held. The switchdev notifier chain can block and sleep, which is forbidden inside an RCU read‑side critical section, creating the possibility of a kernel crash or system instability. This vulnerability does not provide remote code execution but can destabilize the system if triggered.

Affected Systems

All Linux kernel builds that include the bridge MST feature and have not applied the upstream commit that moves the switchdev call outside the RCU section are vulnerable. The issue applies to all mainstream kernel releases that expose this feature, regardless of specific minor version.

Risk and Exploitability

The CVSS score of 7.0 indicates a high severity potential for serious disruption. The EPSS score of less than 1% indicates a very low estimated exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require local or privileged access to send netlink commands while holding the rtnl lock, and no publicly documented remote attack vector is known.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8ca9a750fc711911ef616ceb627d07357b04545e`	affected	< b9661fd2423fc25e91e0517ecc0b6156ad83e3a8
`4488617e5e995a09abe4d81add5fb165674edb59`	affected	< 6b431b63219853eef4054e2f1cb073d2ca2059b4
`3a7c1661ae1383364cd6092d851f5e5da64d476b`	affected	< abf734d150c61acfdfee102169d0e5d1c482e285
`3a7c1661ae1383364cd6092d851f5e5da64d476b`	affected	< d5c4ee1fa4e83a12afc051c831936cd8e006cde3
`3a7c1661ae1383364cd6092d851f5e5da64d476b`	affected	< c40ed3e884c8dc0350f26484030438ef24208ff1
`3a7c1661ae1383364cd6092d851f5e5da64d476b`	affected	< 18a6fe05fb6e18de29fa90d388bb34044114b3d8
`a2b01e65d9ba8af2bb086d3b7288ca53a07249ac`	affected	—
`e43dd2b1ec746e105b7db5f9ad6ef14685a615a4`	affected	—
`6.1.93`	affected	< 6.1.189
`6.6.33`	affected	< 6.6.158
`6.8.12`	affected	< 6.9
`6.9.3`	affected	< 6.10

Linux

affected

Version	Status	Constraints
`6.10`	affected	—
`0`	unaffected	< 6.10
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[8ca9a750fc711911ef616ceb627d07357b04545e,b9661fd2423fc25e91e0517ecc0b6156ad83e3a8)`	affected	generic	—
`[4488617e5e995a09abe4d81add5fb165674edb59,6b431b63219853eef4054e2f1cb073d2ca2059b4)`	affected	generic	—
`[3a7c1661ae1383364cd6092d851f5e5da64d476b,abf734d150c61acfdfee102169d0e5d1c482e285)`	affected	generic	—
`[3a7c1661ae1383364cd6092d851f5e5da64d476b,d5c4ee1fa4e83a12afc051c831936cd8e006cde3)`	affected	generic	—
`[3a7c1661ae1383364cd6092d851f5e5da64d476b,c40ed3e884c8dc0350f26484030438ef24208ff1)`	affected	generic	—
`[3a7c1661ae1383364cd6092d851f5e5da64d476b,18a6fe05fb6e18de29fa90d388bb34044114b3d8)`	affected	generic	—
`a2b01e65d9ba8af2bb086d3b7288ca53a07249ac`	affected	code_commit	—
`e43dd2b1ec746e105b7db5f9ad6ef14685a615a4`	affected	code_commit	—
`[6.1.93,6.1.189)`	affected	semver	—
`[6.6.33,6.6.158)`	affected	semver	—
`[6.8.12,6.9)`	affected	semver	—
`[6.9.3,6.10)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.10`	affected	semver	—
`[0,6.10)`	unaffected	semver	—
`[6.1.189,*]`	unaffected	generic	—
`[6.6.158,*]`	unaffected	generic	—
`[6.12.112,*]`	unaffected	generic	—
`[6.18.54,*]`	unaffected	generic	—
`[7.2.8,*]`	unaffected	generic	—
`[7.3-rc4,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version in which the switchdev call has been moved outside the RCU section.
If a kernel upgrade is not immediately possible, backport the upstream patch that relocates the switchdev call or apply the patch directly to the running kernel.
Modify your bridge MST management workflow so that the rtnl lock is held before any switchdev function calls are made to avoid RCU misuse.

Generated by OpenCVE AI on October 11, 2026 at 18:36 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4841-1	linux security update
Debian DLA	DLA-4850-1	linux-6.12 security update
Debian DSA	DSA-6568-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.180% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98301.mbox
https://git.kernel.org/stable/c/18a6fe05fb6e18de29fa90d388bb34044114b3d8
https://git.kernel.org/stable/c/6b431b63219853eef4054e2f1cb073d2ca2059b4
https://git.kernel.org/stable/c/abf734d150c61acfdfee102169d0e5d1c482e285
https://git.kernel.org/stable/c/b9661fd2423fc25e91e0517ecc0b6156ad83e3a8
https://git.kernel.org/stable/c/c40ed3e884c8dc0350f26484030438ef24208ff1
https://git.kernel.org/stable/c/d5c4ee1fa4e83a12afc051c831936cd8e006cde3
https://nvd.nist.gov/vuln/detail/CVE-2026-98301
https://www.cve.org/CVERecord?id=CVE-2026-98301

History

Oct 11, 2026 5:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-727

Oct 11, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-821
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98301.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98301 https://www.cve.org/CVERecord?id=CVE-2026-98301
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Oct 7, 2026 4:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-727

Oct 6, 2026 6:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-236 CWE-667

Oct 6, 2026 2:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-236 CWE-667

Oct 6, 2026 9:00 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: move switchdev call outside rcu This is a follow-up of one of sashiko's pre-existing bug reports. br_mst_set_state() calls switchdev_port_attr_set() for nonzero MSTIs while holding rcu_read_lock() which invokes the blocking switchdev notifier chain and may sleep. Nonzero MSTI changes come from netlink with rtnl held. Move the switchdev call before entering the rcu section and assert that rtnl is held. The call cannot be deferred because netlink needs its error and extack. Also DSA reads the old bridge MST state during the callback and checks it. A deferred callback will be late and will see the updated state.
Title		net: bridge: mst: move switchdev call outside rcu
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/18a6fe05fb6e18de29fa90d388bb34044114b3d8 https://git.kernel.org/stable/c/6b431b63219853eef4054e2f1cb073d2ca2059b4 https://git.kernel.org/stable/c/abf734d150c61acfdfee102169d0e5d1c482e285 https://git.kernel.org/stable/c/b9661fd2423fc25e91e0517ecc0b6156ad83e3a8 https://git.kernel.org/stable/c/c40ed3e884c8dc0350f26484030438ef24208ff1 https://git.kernel.org/stable/c/d5c4ee1fa4e83a12afc051c831936cd8e006cde3