CVE-2026-97615

A flaw was found in the Linux kernel's network bridge subsystem, which can lead to a Denial of Service (DoS) due to list corruption. When Connectivity Fault Management (CFM) or Media Redundancy Protocol (MRP) handlers are enabled across multiple network bridges, a shared data structure is improperly linked into multiple bridge lists. A local privileged user unregistering the protocol on one bridge can corrupt the active state of another bridge, resulting in a kernel crash.

A low impact vulnerability was found in the Linux kernel's network bridge subsystem. When Connectivity Fault Management (CFM) or Media Redundancy Protocol (MRP) is enabled on multiple bridge devices, a shared frame-handler data structure is linked into each bridge's frame handler list. Unregistering the protocol on one bridge then corrupts the list state belonging to another bridge, which can result in a kernel crash and a local denial of service. Exploiting this flaw requires local access with the privileges needed to configure network bridges (CAP_NET_ADMIN), and it affects availability only, with no impact on confidentiality or integrity.

The kernel packages in Red Hat Enterprise Linux 8, 9, and 10 (including kernel-rt), RHIVOS 2, and the RHEL CoreOS kernels shipped with OpenShift 4 are affected, with the fix deferred to a future update: the upstream solution reworks the bridge frame-handler registration mechanism (replacing the shared handler list with per-bridge option bits) rather than applying a minimal change, and the flaw's low security impact does not justify an expedited update. The residual risk is a local denial of service limited to systems where the uncommon CFM or MRP protocols are enabled across multiple bridge devices. Red Hat Enterprise Linux 7 (kernel and kernel-rt) and Red Hat Enterprise Linux 8.4 are not affected because the vulnerable code is not present in those streams. Although the CVSS:3.1 base score is 5.5 (Moderate), Red Hat rates the impact of this flaw as Low because exploitation requires local privileged access and only availability is affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.