CVE-2026-90114

A flaw was found in the Linux kernel's networking bridge component. When processing specially crafted VLAN (Virtual Local Area Network) tunnel ranges, a logic error can occur where descending VLAN and tunnel IDs are incorrectly handled. This can lead to an unpredictable return value, potentially causing system instability or a denial of service (DoS) condition.

A moderate impact flaw was found in the Linux kernel's networking bridge subsystem. When a bridge VLAN tunnel range configuration request supplies a pair of descending VLAN and tunnel IDs, the pair can pass the tunnel range span check because the VLAN subtraction produces a negative int that is converted to unsigned when compared with the u32 tunnel ID subtraction, and it can therefore equal the wrapped tunnel ID delta. The range loop then performs no iterations and, due to the post-loop error check in the batched notification handling, leaves the error variable uninitialized, making the request's return value unpredictable and potentially causing system instability or a denial of service. Red Hat Enterprise Linux 8, 9, and 10 (including the kernel-rt variant), Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases shipping RHEL CoreOS 8 or RHEL CoreOS 9 are affected; the fix for these products is currently deferred and will be addressed in a future update. The residual risk of the deferral is considered limited because exploiting this flaw requires local access and the ability to issue bridge VLAN tunnel range configuration requests, and the impact is limited to availability, with no impact to confidentiality or integrity. Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support (kernel and kernel-rt) and Red Hat Enterprise Linux 8.4 are not affected because the vulnerable code is not present in those versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.