CVE-2026-43100

In the Linux kernel, the following vulnerability has been resolved: bridge: guard local VLAN-0 FDB helpers against NULL vlan group When CONFIG_BRIDGE_VLAN_FILTERING is not set, br_vlan_group() and nbp_vlan_group() return NULL (br_private.h stub definitions). The BR_BOOLOPT_FDB_LOCAL_VLAN_0 toggle code is compiled unconditionally and reaches br_fdb_delete_locals_per_vlan_port() and br_fdb_insert_locals_per_vlan_port(), where the NULL vlan group pointer is dereferenced via list_for_each_entry(v, &vg->vlan_list, vlist). The observed crash is in the delete path, triggered when creating a bridge with IFLA_BR_MULTI_BOOLOPT containing BR_BOOLOPT_FDB_LOCAL_VLAN_0 via RTM_NEWLINK. The insert helper has the same bug pattern. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] KASAN NOPTI KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7] RIP: 0010:br_fdb_delete_locals_per_vlan+0x2b9/0x310 Call Trace: br_fdb_toggle_local_vlan_0+0x452/0x4c0 br_toggle_fdb_local_vlan_0+0x31/0x80 net/bridge/br.c:276 br_boolopt_toggle net/bridge/br.c:313 br_boolopt_multi_toggle net/bridge/br.c:364 br_changelink net/bridge/br_netlink.c:1542 br_dev_newlink net/bridge/br_netlink.c:1575 Add NULL checks for the vlan group pointer in both helpers, returning early when there are no VLANs to iterate. This matches the existing pattern used by other bridge FDB functions such as br_fdb_add() and br_fdb_delete().

• CWE-476

• https://git.kernel.org/stable/c/1979645e1842cb7017525a61a0e0e0beb924d02aPatch
• https://git.kernel.org/stable/c/ddf0ec2d600e7dad62b89692749534d7900a732aPatch
• https://git.kernel.org/stable/c/fb612d436ff0317659e45a91c25fd7d9516f5b1bPatch

Published

May 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43094In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43095In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43096In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43097In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-43098In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43099In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-43101In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-43102In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43103In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43104In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43105In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43106In the Linux kernel, the following vulnerability has been re…7.8