Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-90114— net: bridge: Reject descending VLAN tunnel ranges

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已修复以下漏洞： 网络：网桥：拒绝降序的 VLAN 隧道范围 一对降序的 VLAN ID 和隧道 ID 能够通过隧道范围跨度检查。VLAN 减法运算会产生一个负的有符号整数，该值在与 u32 类型的隧道 ID 差值进行比较时会被转换为无符号数，因此可能等于发生回绕后的隧道 ID 差值。 随后，范围遍历循环不会执行任何迭代。由于批量通知处理引入了循环后的错误检查，这会导致变量 未初始化，使得该请求的返回值变得不可预测。 修复方法是在比较跨度之前，先拒绝降序的 VLAN 范围。有效的升序范围和单

AI Predicted 5.5 Difficulty: Moderate EPSS 0.22% · P11

Possible ATT&CK Techniques 1 AI

T1527

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 94339443686b36d3223bc032b7947267474e2679< 1181f6bad009408a259bab6aaf0681f11b487972 affected
94339443686b36d3223bc032b7947267474e2679< 5a8e0e3a18b5e3172343b8479c5d04187f5b4795 affected
94339443686b36d3223bc032b7947267474e2679< 0874a6d5275091429ec4c675c54c53a8776665ae affected
94339443686b36d3223bc032b7947267474e2679< 4b0f5b25f114651f03058395b490626c4444875e affected
94339443686b36d3223bc032b7947267474e2679< bd741b819ff1c239d26cc5b0f0e6b1fd4e67ed17 affected
94339443686b36d3223bc032b7947267474e2679< c0444d7499f113d6b7803ef0175591464e17525e affected
94339443686b36d3223bc032b7947267474e2679< 434849b21ef56b09d16e6366b2a230002f363e45 affected
94339443686b36d3223bc032b7947267474e2679< b74a072d8fb71d3c9ffba4a17d5943e63266fb38 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90114

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: bridge: Reject descending VLAN tunnel ranges
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the u32 tunnel ID subtraction. It can therefore equal the wrapped tunnel ID delta. The range loop then performs no iterations. Since the batched notification handling added a post-loop error check, this leaves err uninitialized and makes the request's return value unpredictable. Reject descending VLAN ranges before comparing the spans. Valid ascending and single-entry ranges remain unchanged, while malformed descending ranges consistently return -EINVAL. This issue was found by a static analysis checker and confirmed by manual source review.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 94339443686b36d3223bc032b7947267474e2679 ~ 1181f6bad009408a259bab6aaf0681f11b487972 -
Linux Linux 5.9 -

II. Public POCs for CVE-2026-90114

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90114

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-90114 (8)

Same Patch Batch · Linux · 2026-09-17 · 600 CVEs total

CVE-2026-90173 9.8 CRITICAL smb: smbdirect: free completion queues with ib_free_cq()
CVE-2026-92489 9.8 CRITICAL xfrm: Fix skb double-free in xfrm_dev_direct_output()
CVE-2026-90104 9.8 CRITICAL NFSv4.1: zero referring call lists before decoding
CVE-2026-90235 9.8 CRITICAL sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
CVE-2026-90151 9.8 CRITICAL NFSv4: remove callback IDR entry on client allocation failure
CVE-2026-90110 9.4 CRITICAL inetpeer: randomize RB-tree node comparison using SipHash
CVE-2026-90414 9.1 CRITICAL IB/isert: reject PDUs declaring more data than was received
CVE-2026-90413 9.1 CRITICAL IB/isert: reject login PDUs declaring more data than was received
CVE-2026-90230 9.1 CRITICAL nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
CVE-2026-90381 8.8 HIGH wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
CVE-2026-90329 8.8 HIGH HID: synchronize input before cleaning up a failed probe
CVE-2026-90162 8.8 HIGH ksmbd: defer publishing granted locks to prevent UAF/double-free race
CVE-2026-90357 8.8 HIGH wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
CVE-2026-90367 8.8 HIGH wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
CVE-2026-90371 8.8 HIGH wifi: mt76: fix RXDMAD_C buffer recycling race
CVE-2026-93042 8.8 HIGH dmaengine: dw-edma: Terminate all descriptors without callbacks
CVE-2026-90425 8.8 HIGH iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID
CVE-2026-90240 8.8 HIGH iommu/vt-d: Flush context cache with correct SID when tearing down aliases
CVE-2026-90379 8.8 HIGH wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash
CVE-2026-90256 8.8 HIGH Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind

Showing top 20 of 600 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-90114

No comments yet

Leave a comment