CVE-2026-98301
net: bridge: mst: move switchdev call outside rcu
No known exploitation. EPSS puts it in the 7th percentile. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ 8ca9a750fc711911ef616ceb627d07357b04545e, < b9661fd2423fc25e91e0517ecc0b6156ad83e3a8Upgrade to: b9661fd2423fc25e91e0517ecc0b6156ad83e3a8Affected: ≥ 4488617e5e995a09abe4d81add5fb165674edb59, < 6b431b63219853eef4054e2f1cb073d2ca2059b4Upgrade to: 6b431b63219853eef4054e2f1cb073d2ca2059b4Affected: ≥ 3a7c1661ae1383364cd6092d851f5e5da64d476b, < abf734d150c61acfdfee102169d0e5d1c482e285Upgrade to: abf734d150c61acfdfee102169d0e5d1c482e285Affected: ≥ 3a7c1661ae1383364cd6092d851f5e5da64d476b, < d5c4ee1fa4e83a12afc051c831936cd8e006cde3Upgrade to: d5c4ee1fa4e83a12afc051c831936cd8e006cde3 + 8 more branchesStated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: move switchdev call outside rcu This is a follow-up of one of sashiko's pre-existing bug reports. br_mst_set_state() calls switchdev_port_attr_set() for nonzero MSTIs while holding rcu_read_lock() which invokes the blocking switchdev notifier chain and may sleep. Nonzero MSTI changes come from netlink with rtnl held. Move the switchdev call before entering the rcu section and assert that rtnl is held. The call cannot be deferred because netlink needs its error and extack. Also DSA reads the old bridge MST state during the callback and checks it. A deferred callback will be late and will see the updated state.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.2% chance of exploitation activity in the next 30 days, which ranks it in the 7th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
2 events over 0 days, from the signal feeds we watch.
- Publishedrecord updated
Affected products
Sources
References in the record
- git.kernel.org/stable/c/18a6fe05fb6e18de29fa90d388bb34044114b3d8
- git.kernel.org/stable/c/6b431b63219853eef4054e2f1cb073d2ca2059b4
- git.kernel.org/stable/c/abf734d150c61acfdfee102169d0e5d1c482e285
And 3 more references. See all after sign-in
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI