CVE-2026-97615

What the bug is

CFM and MRP register a global br_frame_type whose hlist_node is linked into the per-bridge frame_type_list when the first MEP/MRP instance is created. Enabling the protocol on multiple bridges therefore inserts the same node into multiple lists. Unregistering it on one bridge then corrupts list state belonging to another. These handlers can only be installed once per bridge, and they are uncommon. Track their per-bridge enable state with net_bridge option bits, which already live on the Rx hot cache line, and dispatch the matching handler directly from the receive path. Check both bits together first as an unlikely case. Remove the generic frame_type_list and br_frame_type helpers, which have had no other users since CFM and MRP were added. That shrinks struct net_bridge by 8 bytes and drops the list walk from the fast path. When neither protocol is compiled in, BR_CFM_MRP_OPTS is 0 and the compiler prunes the branch.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/bridge/br_cfm.c
net/bridge/br_device.c
net/bridge/br_input.c
net/bridge/br_mrp.c
net/bridge/br_private.h

What this is

ETHERNET BRIDGEMAINTAINERS section matched on net/bridge/ · bridge@lists.linux.dev · Maintained

Kernel module

none to look for. The file would have gone into bridge, and Debian does not compile it into that module, so finding bridge in lsmod would say nothing about this CVE.

Check it on the machine

grep -wE 'CONFIG_BRIDGE|CONFIG_BRIDGE_CFM' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

Show whether Debian builds this, per release

Debian does not build this code. In 4 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.

• bookworm, trixie, forky, sidn

n

not enabled on any flavour - this release does not build the code

Build switches

CONFIG_BRIDGE, CONFIG_BRIDGE_CFM

Reads as

all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-09-25 (24 days ago)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

0.20%, higher than 9.2% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

net/bridge

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
5.11	6.12.112	be5ead655241
5.11	6.18.53	994fd705ca49
5.11	7.2.7	42e033c8f30f
5.11	7.3	7a49e6b16f36

Debian advisories