CVE-2026-98285 net: bridge: vlan: fix bugs caused by switchdev deletion errors
A null pointer dereference in the Linux kernel bridge VLAN code can cause a system crash when switchdev deletion errors occur.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98285?
CVE-2026-98285 is a vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: vlan: fix bugs caused by switchdev deletion errors
Allowing switchdev to prevent vlan deletion and error out in __vlan_del could cause multiple different issues - inconsistent state, memory leaks when flushing, NULL pointer dereference on bridge error when flushing. It doesn't make sense to allow it to stop __vlan_del, so log the error and continue with software vlan deletion. This is also consistent with 8021q behaviour.
Which versions are affected by CVE-2026-98285?
How do I fix CVE-2026-98285?
Apply the vendor's patch.
Is CVE-2026-98285 being exploited?
There is no known exploitation of CVE-2026-98285 in the wild and no public exploit code.
Sources
Also known as AZL-106155, BELL-CVE-2026-98285, DEBIAN-CVE-2026-98285, GHSA-9v49-jvp7-mg86, UBUNTU-CVE-2026-98285.