Description
In the Linux kernel, the following vulnerability has been resolved:
rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
In the commit d73ef2d69c0d ("rtnetlink: let rtnl_bridge_setlink checks
IFLA_BRIDGE_MODE length"), an adjustment was made to the old loop logic
in the function `rtnl_bridge_setlink` to enable the loop to also check
the length of the IFLA_BRIDGE_MODE attribute. However, this adjustment
removed the `break` statement and led to an error logic of the flags
writing back at the end of this function.
if (have_flags)
memcpy(nla_data(attr), &flags, sizeof(flags));
// attr should point to IFLA_BRIDGE_FLAGS NLA !!!
Before the mentioned commit, the `attr` is granted to be IFLA_BRIDGE_FLAGS.
However, this is not necessarily true fow now as the updated loop will let
the attr point to the last NLA, even an invalid NLA which could cause
overflow writes.
This patch introduces a new variable `br_flag` to save the NLA pointer
that points to IFLA_BRIDGE_FLAGS and uses it to resolve the mentioned
error logic.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 5.4.253 – < 5.4.271, 5.10.190 – < 5.10.212, 5.15.126 – < 5.15.151, 6.1.45 – < 6.1.81, 6.4.10 – < 6.5, 6.5 | 5.4.271 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.7.9-1 | — |
| Debian 13 | linux | 6.7.9-1 | — |
| Debian 12 | linux | 6.1.82-1 | — |
| Debian 10 | linux-5.10 | 5.10.216-1~deb10u1 | DLA-3842-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | 5.15.0-1044.46 | — |
| Ubuntu 22.04 LTS | linux | 5.15.0-112.122 | USN-6820-1 |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1063.69 | USN-6821-3 |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1066.75 | USN-6821-4 |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1067.76.1 | USN-6821-4 |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1062.70 | USN-6820-1 |
| Ubuntu 22.04 LTS | linux-gke | 5.15.0-1060.66 | USN-6821-1 |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1046.53 | USN-6821-2 |
| Ubuntu 22.04 LTS | linux-ibm | 5.15.0-1056.59 | USN-6821-1 |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1058.64 | USN-6821-1 |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1060.65 | USN-6821-2 |
| Ubuntu 22.04 LTS | linux-lowlatency | 5.15.0-110.120 | USN-6820-1 |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1058.59 | USN-6820-2 |
| Ubuntu 22.04 LTS | linux-nvidia-tegra | 5.15.0-1026.26 | — |
| Ubuntu 22.04 LTS | linux-nvidia-tegra-igx | 5.15.0-1015.15 | — |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1061.67 | USN-6821-1 |
| Ubuntu 22.04 LTS | linux-raspi | 5.15.0-1058.61 | USN-6919-1 |
| Ubuntu 22.04 LTS | linux-riscv +31 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-xilinx-zynqmp | 5.15.0-1030.34 | USN-6820-1 |
| Ubuntu 20.04 LTS | linux | 5.4.0-186.206 | USN-6831-1 |
| Ubuntu 20.04 LTS | linux-aws | 5.4.0-1126.136 | USN-6831-1 |
| Ubuntu 20.04 LTS | linux-aws-5.15 | 5.15.0-1063.69~20.04.1 | USN-6821-3 |
| Ubuntu 20.04 LTS | linux-azure | 5.4.0-1131.138 | USN-6831-1 |
| Ubuntu 20.04 LTS | linux-azure-5.15 | 5.15.0-1065.74~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-bluefield | 5.4.0-1086.93 | USN-6867-1 |
| Ubuntu 20.04 LTS | linux-gcp | 5.4.0-1130.139 | USN-6831-1 |
| Ubuntu 20.04 LTS | linux-gcp-5.15 | 5.15.0-1062.70~20.04.1 | USN-6820-1 |
| Ubuntu 20.04 LTS | linux-gke +26 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gkeop | 5.4.0-1093.97 | USN-6831-1 |
| Ubuntu 20.04 LTS | linux-gkeop-5.15 | 5.15.0-1046.53~20.04.1 | USN-6821-2 |
| Ubuntu 20.04 LTS | linux-hwe-5.15 | 5.15.0-113.123~20.04.1 | USN-6871-1 |
| Ubuntu 20.04 LTS | linux-ibm | 5.4.0-1073.78 | USN-6831-1 |
| Ubuntu 20.04 LTS | linux-ibm-5.15 | 5.15.0-1057.60~20.04.1 | USN-6892-1 |
| Ubuntu 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1058.64~20.04.1 | USN-6828-1 |
| Ubuntu 20.04 LTS | linux-iot | 5.4.0-1038.39 | USN-6867-1 |
| Ubuntu 20.04 LTS | linux-kvm | 5.4.0-1114.121 | USN-6831-1 |
| Ubuntu 20.04 LTS | linux-lowlatency-hwe-5.15 | 5.15.0-110.120~20.04.1 | USN-6820-1 |
| Ubuntu 20.04 LTS | linux-nvidia-tegra-5.15 | 5.15.0-1027.27~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-oracle | 5.4.0-1125.134 | USN-6831-1 |
| Ubuntu 20.04 LTS | linux-oracle-5.15 | 5.15.0-1061.67~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-raspi | 5.4.0-1110.122 | USN-6831-1 |
| Ubuntu 20.04 LTS | linux-riscv-5.15 | 5.15.0-1059.63~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-xilinx-zynqmp | 5.4.0-1045.49 | USN-6831-1 |
| Ubuntu 18.04 LTS | linux-gcp +13 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro Realtime 24.04 LTS | linux-raspi-realtime | 6.8.0-2002.2 | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-intel-iot-realtime | 5.15.0-1056.58 | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1064.72 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-aws-fips | 5.15.0-1063.69+fips1 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-azure-fips | 5.15.0-1065.74+fips1 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-fips | 5.15.0-111.121+fips1 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-gcp-fips | 5.15.0-1062.70+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-aws-fips | 5.4.0-1126.136+fips2 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-azure-fips | 5.4.0-1131.138+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips | 5.4.0-1100.110 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-gcp-fips | 5.4.0-1130.139+fips1 | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-aws-fips +2 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux-aws-5.4 | 5.4.0-1126.136~18.04.1 | USN-6831-1 |
| Ubuntu Pro 18.04 LTS | linux-azure-5.4 | 5.4.0-1131.138~18.04.1 | USN-6831-1 |
| Ubuntu Pro 18.04 LTS | linux-gcp-5.4 | 5.4.0-1130.139~18.04.1 | USN-6831-1 |
| Ubuntu Pro 18.04 LTS | linux-hwe-5.4 | 5.4.0-186.206~18.04.1 | USN-6831-1 |
| Ubuntu Pro 18.04 LTS | linux-ibm-5.4 | 5.4.0-1073.78~18.04.1 | USN-6831-1 |
| Ubuntu Pro 18.04 LTS | linux-oracle-5.4 | 5.4.0-1125.134~18.04.1 | USN-6831-1 |
| Ubuntu Pro 18.04 LTS | linux-raspi-5.4 | 5.4.0-1110.122~18.04.1 | USN-6831-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | bpftool | 7.4.0-503.11.1.el9_5 | RHSA-2024:9315 |
| RHEL 9 | rv +67 | 5.14.0-503.11.1.el9_5 | RHSA-2024:9315 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | kernel-64kb | 6.4.0-150600.23.14.1 | SUSE-SU-2024:2571-1 |
| SLES 15 SP6 | kernel-azure +1 | 6.4.0-150600.8.8.2 | SUSE-SU-2024:2896-1 |
| SLES 15 SP6 | kernel-default-base | 6.4.0-150600.23.14.2.150600.12.4.3 | SUSE-SU-2024:2571-1 |
| SLES 15 SP6 | kernel-docs +5 | 6.4.0-150600.23.14.2 | SUSE-SU-2024:2571-1 |
| SLES 15 SP6 | kernel-syms-azure | 6.4.0-150600.8.8.1 | SUSE-SU-2024:2896-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.0 | kernel-default-base | 6.4.0-17.1.1.51 | SUSE-SU-2025:20008-1 |
| SLE Micro 6.0 | kernel-rt +1 | 6.4.0-9.1 | SUSE-SU-2025:20028-1 |
| SLE Micro 6.0 | kernel-source +2 | 6.4.0-18.1 | SUSE-SU-2025:20008-1 |
| SLE Live Patching 15 SP6 | kernel-default | 6.4.0-150600.23.14.2 | SUSE-SU-2024:2571-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_1 | 1-150600.1.5.1 | SUSE-SU-2024:2973-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_2 | 1-150600.13.3.2 | SUSE-SU-2024:2571-1 |
| SUSE Real Time Module 15 SP6 | kernel-rt +3 | 6.4.0-150600.10.5.1 | SUSE-SU-2024:2973-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | dtb-aarch64 +1 | 6.4.0-150600.23.14.1 | SUSE-SU-2024:2571-1 |
| openSUSE Leap 15.6 | kernel-azure +1 | 6.4.0-150600.8.8.2 | SUSE-SU-2024:2896-1 |
| openSUSE Leap 15.6 | kernel-default-base | 6.4.0-150600.23.14.2.150600.12.4.3 | SUSE-SU-2024:2571-1 |
| openSUSE Leap 15.6 | kernel-docs +8 | 6.4.0-150600.23.14.2 | SUSE-SU-2024:2571-1 |
| openSUSE Leap 15.6 | kernel-rt +3 | 6.4.0-150600.10.5.1 | SUSE-SU-2024:2973-1 |
| openSUSE Leap 15.6 | kernel-syms-azure | 6.4.0-150600.8.8.1 | SUSE-SU-2024:2896-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.1.82-99.168 | 1.0-0.amzn2023 | ALAS2023-2024-784 |
| Amazon Linux 2023 | perf +14 | 6.1.82-99.168.amzn2023 | ALAS2023-2024-784 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | bpftool | 7.4.0-503.11.1.el9_5 | ELSA-2024-9315 |
| Oracle Linux 9 | rv +28 | 5.14.0-503.11.1.el9_5 | ELSA-2024-9315 |
Advisories 25
- WID-SEC-2024-1188 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 9, 2026
- USN-6828-1 linux-intel-iotg-5.15 vulnerabilities Ubuntu Security Notices (USN) · Oct 29, 2026
- USN-6831-1 linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- USN-6919-1 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- USN-6821-4 linux-azure, linux-azure-fde vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- USN-6871-1 linux-hwe-5.15 vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- USN-6867-1 linux-bluefield, linux-iot vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- USN-6820-1 linux, linux-gcp, linux-gcp-5.15, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-xilinx-zynqmp vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- USN-6821-1 linux-gke, linux-ibm, linux-intel-iotg, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- USN-6821-2 linux-gkeop, linux-gkeop-5.15, linux-kvm vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- USN-6821-3 linux-aws, linux-aws-5.15 vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- USN-6892-1 linux-ibm-5.15 vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- USN-6820-2 linux-nvidia vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- RHSA-2024:9315 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- SUSE-SU-2025:20008-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20028-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-3842-1 linux-5.10 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ICSA-25-226-15 Siemens SINEC OS CISA ICS & IT advisories · Feb 25, 2026
- SSA-613116 SSA-613116: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.1 Siemens ProductCERT · Feb 24, 2026
- ALAS2023-2024-784 Important: kernel security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 11, 2026
- SUSE-SU-2024:2973-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2896-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1293 IBM DataPower Gateway: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 3, 2025
- SUSE-SU-2024:2571-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2024-9315 Moderate: kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 14, 2024
References
- https://git.kernel.org/stable/c/b9fbc44159dfc3e9a7073032752d9e03f5194a6f
- https://git.kernel.org/stable/c/882a51a10ecf24ce135d573afa0872aef02c5125
- https://git.kernel.org/stable/c/a1227b27fcccc99dc44f912b479e01a17e2d7d31
- https://git.kernel.org/stable/c/f2261eb994aa5757c1da046b78e3229a3ece0ad9
- https://git.kernel.org/stable/c/167d8642daa6a44b51de17f8ff0f584e1e762db7
- https://git.kernel.org/stable/c/831bc2728fb48a8957a824cba8c264b30dca1425
- https://git.kernel.org/stable/c/743ad091fb46e622f1b690385bb15e3cd3daf874