CVE-2026-98301

A flaw was found in the Linux kernel's network bridge subsystem. A local user with network configuration privileges can trigger a Denial of Service (DoS) by updating bridge Multiple Spanning Tree (MST) states. Because a blocking operation is invoked within an atomic execution context that cannot safely sleep, this flaw can cause kernel instability and crash the system.

br_mst_set_state can invoke the blocking switchdev notifier chain while holding rcu_read_lock. A notifier callback that sleeps can violate the RCU read side execution rules and may cause a sleeping while atomic warning, a prolonged stall, or a driver dependent deadlock. The trigger is a local netlink control plane operation that changes a nonzero MSTI state while RTNL is held. It is not directly reachable through ordinary remote packet traffic. For the CVSS the PR:L in the paranoid score reflects environments where CAP_NET_ADMIN is delegated to a network service, container root, or a user in a network namespace rather than requiring unrestricted host root. Impact is primarily denial of service. No UAF, OOB access, information leak, or write primitive is demonstrated by this patch.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.