Skip to main content

Linux Kernel CVE-2026-43100

| EUVDEUVD-2026-27610 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-06 Linux GHSA-r5qw-5m8q-6774
Denial Of Service Linux Null Pointer Dereference Red Hat Canonical Suse
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Unprivileged user opens netlink socket
  2. Delivery
    Craft RTM_NEWLINK message with BR_BOOLOPT_FDB_LOCAL_VLAN_0
  3. Exploit
    Kernel bridge module processes toggle request
  4. Execution
    br_fdb_delete_locals_per_vlan_port() dereferences NULL vg pointer
  5. Persist
    Kernel null-ptr-deref Oops
  6. Impact
    System denial of service

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Local user access with capability to create network bridges (CAP_NET_ADMIN or netlink socket access). Kernel must be compiled with CONFIG_BRIDGE=y and CONFIG_BRIDGE_VLAN_FILTERING=n. The RTM_NEWLINK netlink message must contain IFLA_BR_MULTI_BOOLOPT with BR_BOOLOPT_FDB_LOCAL_VLAN_0 set. Exploitation is NOT possible if CONFIG_BRIDGE_VLAN_FILTERING=y (default in most distribution kernels), which provides a valid vlan group pointer. The vulnerability is limited to local authenticated attackers; no remote exploitation vector exists.
Impact

CVSS 5.5 (Local, Low Complexity, Low Privilege, No User Interaction) reflects moderate real-world risk. EPSS 0.02% percentile (4th percentile) indicates this is a low-probability exploitation target in typical networks, likely because it requires local access, low privileges (PR:L), and a specific non-default kernel configuration (CONFIG_BRIDGE_VLAN_FILTERING disabled). The attack surface is confined to systems running Linux with bridge module loaded and unprivileged user ability to invoke netlink RTM_NEWLINK operations. The kernel panic (Oops) represents availability impact only-no privilege escalation or data breach vector. Risk is elevated in containerized environments or multi-tenant systems where local users can create network namespaces; lower in typical single-tenant servers. Patch availability and simplicity (NULL checks) further reduce real-world risk. This is a legitimate local DoS but not a critical severity issue for most deployments.
Exploit ScenarioDerived

An unprivileged local user on a Linux system with bridge module loaded and CONFIG_BRIDGE_VLAN_FILTERING disabled creates a new bridge via netlink RTM_NEWLINK with IFLA_BR_MULTI_BOOLOPT containing BR_BOOLOPT_FDB_LOCAL_VLAN_0 flag. This triggers br_fdb_toggle_local_vlan_0() → br_fdb_delete_locals_per_vlan_port(), which dereferences a NULL vlan group pointer, causing a kernel Oops and denial of service.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 11, 2026

Null pointer dereference in Linux kernel bridge VLAN filtering code allows local authenticated attackers to trigger a denial of service via a crafted RTM_NEWLINK netlink message with BR_BOOLOPT_FDB_LOCAL_VLAN_0 flag when CONFIG_BRIDGE_VLAN_FILTERING is disabled. The vulnerability occurs because br_fdb_delete_locals_per_vlan_port() and br_fdb_insert_locals_per_vlan_port() dereference a NULL vlan group pointer without validation, causing a kernel panic. No public exploit code identified at time of analysis.

RemediationAI

Apply vendor-released patch from stable kernel branches: Linux 6.19.14, 6.18.24, or 7.0 or later. The fix adds NULL pointer checks in br_fdb_delete_locals_per_vlan_port() and br_fdb_insert_locals_per_vlan_port() to return early if vg is NULL, matching existing patterns in br_fdb_add() and br_fdb_delete(). Systems unable to immediately patch should restrict unprivileged user access to netlink socket creation via seccomp/selinux policies or disable bridge module if not required (rmmod br). For systems with CONFIG_BRIDGE_VLAN_FILTERING enabled (default in most distributions), exploitation is not possible, making this primarily a risk to minimal embedded/custom kernel builds. Patches are available from kernel.org stable branches: https://git.kernel.org/stable/c/fb612d436ff0317659e45a91c25fd7d9516f5b1b

Affected VersionsENISA

Linux patch: 6.19.14
Linux 21446c06b441b9c993870efae71aef4e9aa72ec7 <1979645e1842cb7017525a61a0e0e0beb924d02a
Linux 21446c06b441b9c993870efae71aef4e9aa72ec7 <ddf0ec2d600e7dad62b89692749534d7900a732a
Linux 6.18
Linux patch: 0
Linux 21446c06b441b9c993870efae71aef4e9aa72ec7 <fb612d436ff0317659e45a91c25fd7d9516f5b1b
Linux patch: 6.18.24
Linux patch: 7.0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Linux kernel bridge module implements VLAN filtering via the br_vlan_group() function, which returns NULL when CONFIG_BRIDGE_VLAN_FILTERING is not compiled in (stub definition in br_private.h). However, the BR_BOOLOPT_FDB_LOCAL_VLAN_0 toggle functionality is compiled unconditionally and attempts to iterate over the vlan group using list_for_each_entry(v, &vg->vlan_list, vlist) without checking if vg is NULL. This is a classic NULL pointer dereference (CWE-476) triggered when netlink RTM_NEWLINK messages create a bridge with IFLA_BR_MULTI_BOOLOPT containing the FDB local VLAN 0 flag. The bug pattern exists in both the delete and insert helper functions due to asymmetric guard coverage-other bridge FDB functions like br_fdb_add() and br_fdb_delete() properly check for NULL vlan groups before proceeding.

Know when Canonical gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
May 11, 2026 - 17:37 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 11:31 EUVD
CVE Published
May 06, 2026 - 07:40 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bridge: guard local VLAN-0 FDB helpers against NULL vlan group

When CONFIG_BRIDGE_VLAN_FILTERING is not set, br_vlan_group() and nbp_vlan_group() return NULL (br_private.h stub definitions). The BR_BOOLOPT_FDB_LOCAL_VLAN_0 toggle code is compiled unconditionally and reaches br_fdb_delete_locals_per_vlan_port() and br_fdb_insert_locals_per_vlan_port(), where the NULL vlan group pointer is dereferenced via list_for_each_entry(v, &vg->vlan_list, vlist).

The observed crash is in the delete path, triggered when creating a bridge with IFLA_BR_MULTI_BOOLOPT containing BR_BOOLOPT_FDB_LOCAL_VLAN_0 via RTM_NEWLINK. The insert helper has the same bug pattern.

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] KASAN NOPTI KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7] RIP: 0010:br_fdb_delete_locals_per_vlan+0x2b9/0x310 Call Trace: br_fdb_toggle_local_vlan_0+0x452/0x4c0 br_toggle_fdb_local_vlan_0+0x31/0x80 net/bridge/br.c:276 br_boolopt_toggle net/bridge/br.c:313 br_boolopt_multi_toggle net/bridge/br.c:364 br_changelink net/bridge/br_netlink.c:1542 br_dev_newlink net/bridge/br_netlink.c:1575

Add NULL checks for the vlan group pointer in both helpers, returning early when there are no VLANs to iterate. This matches the existing pattern used by other bridge FDB functions such as br_fdb_add() and br_fdb_delete().

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Canonical

View all
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
CVE-2013-2423 LOW POC
3.7 Apr 17

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43100 ADVISORY https://vuldb.com/vuln/361345 REF https://git.kernel.org/stable/c/1979645e1842cb7017525a61a0e0e0beb924d02a REF https://git.kernel.org/stable/c/ddf0ec2d600e7dad62b89692749534d7900a732a REF https://git.kernel.org/stable/c/fb612d436ff0317659e45a91c25fd7d9516f5b1b

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy