CVE-2026-43100: Linux Kernel Privilege Escalation Flaw

CVE-2026-43100 Overview

CVE-2026-43100 is a NULL pointer dereference vulnerability in the Linux kernel bridge subsystem. The flaw resides in the local VLAN-0 forwarding database (FDB) helpers br_fdb_delete_locals_per_vlan_port() and br_fdb_insert_locals_per_vlan_port(). When CONFIG_BRIDGE_VLAN_FILTERING is disabled, br_vlan_group() and nbp_vlan_group() return NULL via stub definitions in br_private.h. The BR_BOOLOPT_FDB_LOCAL_VLAN_0 toggle code is compiled unconditionally and dereferences the NULL VLAN group pointer through list_for_each_entry(v, &vg->vlan_list, vlist). The kernel maintainers have resolved the issue by adding NULL checks to both helpers.

Critical Impact
Local users can trigger a kernel general protection fault by creating a bridge with IFLA_BR_MULTI_BOOLOPT containing BR_BOOLOPT_FDB_LOCAL_VLAN_0 via RTM_NEWLINK, resulting in denial of service.

Affected Products

Linux kernel builds with CONFIG_BRIDGE_VLAN_FILTERING disabled
Linux kernel versions including the BR_BOOLOPT_FDB_LOCAL_VLAN_0 toggle code prior to the upstream fix
Distributions shipping affected kernel revisions tracked in the stable trees

Discovery Timeline

2026-05-06 - CVE-2026-43100 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43100

Vulnerability Analysis

The vulnerability exists in the Linux kernel bridge module within net/bridge/. The BR_BOOLOPT_FDB_LOCAL_VLAN_0 boolean option controls whether local FDB entries are programmed against VLAN 0. The toggle handlers iterate the VLAN group via list_for_each_entry(v, &vg->vlan_list, vlist) without first verifying that vg is non-NULL.

When the kernel is built without CONFIG_BRIDGE_VLAN_FILTERING, the inline stubs for br_vlan_group() and nbp_vlan_group() defined in br_private.h always return NULL. The toggle code, however, is compiled unconditionally. The result is a NULL pointer dereference in kernel context that surfaces as a general protection fault, captured by KASAN as null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7].

Root Cause

The defect is a missing input validation check [CWE-476]. The functions br_fdb_delete_locals_per_vlan_port() and br_fdb_insert_locals_per_vlan_port() assume the bridge VLAN group pointer is always valid. Other bridge FDB functions such as br_fdb_add() and br_fdb_delete() already follow the correct pattern of returning early when no VLAN group is present.

Attack Vector

A local user with CAP_NET_ADMIN can trigger the crash by issuing an RTM_NEWLINK netlink message that creates a bridge device with IFLA_BR_MULTI_BOOLOPT setting BR_BOOLOPT_FDB_LOCAL_VLAN_0. The call chain reaches br_changelink() and br_dev_newlink() in net/bridge/br_netlink.c, which invokes br_boolopt_multi_toggle() and then br_fdb_toggle_local_vlan_0(). The handler dereferences the NULL VLAN group, halting the kernel thread and causing a denial of service.

No verified exploitation code is publicly available. The reproducer is the netlink request described in the upstream commit message.

Detection Methods for CVE-2026-43100

Indicators of Compromise

Kernel oops messages referencing br_fdb_delete_locals_per_vlan or br_fdb_toggle_local_vlan_0 in dmesg or /var/log/kern.log
KASAN reports of null-ptr-deref originating from net/bridge/br.c or net/bridge/br_netlink.c
Unexpected bridge interface creation events followed by host instability or panic

Detection Strategies

Monitor kernel ring buffer output for general protection faults that resolve to bridge subsystem symbols
Audit netlink RTM_NEWLINK traffic that includes the IFLA_BR_MULTI_BOOLOPT attribute targeting BR_BOOLOPT_FDB_LOCAL_VLAN_0
Track invocations of the ip link add type bridge command on hosts where bridge networking is not part of the expected workload

Monitoring Recommendations

Forward kernel logs to a centralized analytics platform and alert on bridge oops signatures
Audit which user accounts hold CAP_NET_ADMIN and review whether any container or namespace exposes that capability unnecessarily
Track the running kernel version across the fleet and flag hosts that have not received the patched build

How to Mitigate CVE-2026-43100

Immediate Actions Required

Apply the upstream stable kernel patches that add NULL checks to br_fdb_delete_locals_per_vlan_port() and br_fdb_insert_locals_per_vlan_port()
Reboot affected hosts after installing the patched kernel package to ensure the fix is loaded
Restrict CAP_NET_ADMIN to trusted administrators and remove it from unprivileged container profiles

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Refer to the upstream commits at Kernel Change Log Entry 1, Kernel Change Log Entry 2, and Kernel Change Log Entry 3. The fix adds an early return when the VLAN group pointer is NULL, matching the pattern already used by br_fdb_add() and br_fdb_delete().

Workarounds

Build the kernel with CONFIG_BRIDGE_VLAN_FILTERING=y so that br_vlan_group() returns a valid VLAN group rather than NULL
Avoid setting BR_BOOLOPT_FDB_LOCAL_VLAN_0 in IFLA_BR_MULTI_BOOLOPT payloads when creating bridge interfaces on unpatched kernels
Use seccomp or AppArmor profiles to restrict netlink socket access for non-administrative workloads

bash

# Check whether the running kernel was built with bridge VLAN filtering enabled
zgrep CONFIG_BRIDGE_VLAN_FILTERING /proc/config.gz 2>/dev/null \
    || grep CONFIG_BRIDGE_VLAN_FILTERING /boot/config-$(uname -r)

# Identify hosts running bridge interfaces that may be exposed
ip -details link show type bridge