CVE-2026-74659

What the bug is

br_mrp_alloc_test_skb() builds MRP test frames on an skb from dev_alloc_skb(), which does not clear the linear data area. On the MRA ring-role branch the sub-option TLV header is appended with sub_tlv = skb_put(skb, sizeof(*sub_tlv)); sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR; so sub_tlv->length is never written, and the two trailing alignment bytes are appended with a bare skb_put() that does not clear them either. The neighbouring oui and sub_opt regions are explicitly zeroed, so three uninitialised bytes are left in every MRA MRP_Test frame that goes out. Put the sub-option TLV header and the alignment padding in a single skb_put_zero(), which clears both. The AUTO_MGR sub-TLV carries no payload, so the zeroed length field is already the value it should have.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/bridge/br_mrp.c

What this is

ETHERNET BRIDGEMAINTAINERS section matched on net/bridge/ · bridge@lists.linux.dev · Maintained

Kernel module

none to look for. The file would have gone into bridge, and Debian does not compile it into that module, so finding bridge in lsmod would say nothing about this CVE.

Check it on the machine

grep -wE 'CONFIG_BRIDGE|CONFIG_BRIDGE_MRP' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

Show whether Debian builds this, per release

Debian does not build this code. In 5 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.

• bookworm, trixie, forky, sid, bookworm · linux-6.12n

n

not enabled on any flavour - this release does not build the code

Build switches

CONFIG_BRIDGE, CONFIG_BRIDGE_MRP

Reads as

all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-08-22 (2 months ago)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

0.17%, higher than 6.2% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

net/bridge

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
5.14	5.15.216	014c062d23c6
5.14	6.1.183	7ebc23ff0366
5.14	6.6.152	06d58b8d2f05
5.14	6.12.104	a5e385eeb2d6
5.14	6.18.45	5912cf1822fb
5.14	7.1.9	e08665218040
5.14	7.2	63488dba65ef

Debian advisories