CVE-2026-64032 - Vulnerability Details

- bridge: mcast: Fix a possible use-after-free when removing a bridge port

Description

In the Linux kernel, the following vulnerability has been resolved:

bridge: mcast: Fix a possible use-after-free when removing a bridge port

When per-VLAN multicast snooping is enabled, the bridge iterates over
all the bridge ports, disables the per-port multicast context on each
port and enables the per-{port, VLAN} multicast contexts instead. The
reverse happens when per-VLAN multicast snooping is disabled.

When global multicast snooping is enabled, the bridge iterates over all
the bridge ports and enables the per-port multicast context on each
port. The reverse happens when multicast snooping is disabled.

The above scheme can result in a situation where both types of contexts
(per-port and per-{port, VLAN}) are enabled on a single bridge port:

# ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1
# ip link add name dummy1 up master br1 type dummy
# ip link set dev br1 type bridge mcast_vlan_snooping 1
# ip link set dev br1 type bridge mcast_snooping 0
# ip link set dev br1 type bridge mcast_snooping 1

This is not intended and it is a problem since the commit cited below.
Prior to this commit, when removing a bridge port,
br_multicast_disable_port() would disable the per-port multicast context
and the per-{port, VLAN} multicast contexts would get disabled when
flushing VLANs.

After this commit, br_multicast_disable_port() only disables the
per-port multicast context if per-VLAN multicast snooping is disabled.
If both types of contexts were enabled on the port when it was removed,
the per-port multicast context would remain enabled when freeing the
bridge port, leading to a use-after-free [1].

Fix by preventing the bridge from enabling / disabling the per-port
multicast contexts when toggling global multicast snooping if per-VLAN
multicast snooping is enabled.

[1]
ODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer_list hint: br_ip6_multicast_port_query_expired (net/bridge/br_multicast.c:1927)
WARNING: lib/debugobjects.c:629 at debug_print_object+0x1b1/0x3e0, CPU#5: swapper/5/0
[...]
Call Trace:
<IRQ>
__debug_check_no_obj_freed (lib/debugobjects.c:1116)
kfree (mm/slub.c:2620 mm/slub.c:6250 mm/slub.c:6565)
kobject_cleanup (lib/kobject.c:689)
rcu_do_batch (kernel/rcu/tree.c:2617)
rcu_core (kernel/rcu/tree.c:2869)
handle_softirqs (kernel/softirq.c:622)
__irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735)
irq_exit_rcu (kernel/softirq.c:752)
sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 47) arch/x86/kernel/apic/apic.c:1061 (discriminator 47))
</IRQ>

Published: 2026-07-19

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The defect lies in the Linux kernel’s bridge multicast subsystem. When per‑VLAN multicast snooping is enabled, the code can enable both per‑port and per‑VLAN multicast contexts on a bridge port. If a port is removed while both contexts remain enabled, the per‑port context is not cleared properly; when the port is freed the timer associated with the per‑port context is freed while still referenced, causing a use‑after‑free. This flaw is a classic memory corruption problem aligned with CWE‑825.

Affected Systems

All Linux kernel builds that include the bridge multicast logic and have per‑VLAN multicast snooping enabled are impacted. The issue exists in releases prior to the commit that added the fix. Administrators should verify the kernel version and apply the updated kernel release containing the patch, or ensure that bridges are not configured with both global and per‑VLAN multicast snooping active before removing ports.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity, while the EPSS score of <1% suggests exploitation is uncommon. The likely attack vector is local, requiring an attacker to have privilege to alter bridge configuration (typically a system administrator). If exploited, the use‑after‑free could enable execution of arbitrary privileged code or cause a kernel panic leading to denial of service. The vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`410a033bfa8c7daefbae0225c836693db2149ec1`	affected	< ddefd1b8e5eb58933a697ab38334f0fd82e7fb8b
`c6d16eab122744df698f18b47cf771945cd55066`	affected	< ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70
`b4c83b37490d61cfdd62a2b29e98a9b89004b5c0`	affected	< 1900ca8acb92fbea8bf9abef9927c7fed03db7fc
`78f768e36c065ca3f88272fcf39014782c2d4ecd`	affected	< ebe5561154c823b323bd06e350b55e0b8604d851
`4b30ae9adb047dd0a7982975ec3933c529537026`	affected	< a9224862d597d0eed0a34bbb27343f703fc4113f
`4b30ae9adb047dd0a7982975ec3933c529537026`	affected	< 7213256c91ed778a0997c2029c152b18dc50e4fd
`4b30ae9adb047dd0a7982975ec3933c529537026`	affected	< 4df78ff02629c7729168f0696a7a2123c389818d
`c996e25df0b3282c724bb5aca434518bc08cd963`	affected	—
`5.15.186`	affected	< 5.15.209
`6.1.142`	affected	< 6.1.175
`6.6.95`	affected	< 6.6.142
`6.12.35`	affected	< 6.12.92
`6.15.4`	affected	< 6.16

Linux

affected

Version	Status	Constraints
`6.16`	affected	—
`0`	unaffected	< 6.16
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.142`	unaffected	≤ 6.6.*
`6.12.92`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[410a033bfa8c7daefbae0225c836693db2149ec1,ddefd1b8e5eb58933a697ab38334f0fd82e7fb8b)`	affected	code_commit	—
`[c6d16eab122744df698f18b47cf771945cd55066,ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70)`	affected	code_commit	—
`[b4c83b37490d61cfdd62a2b29e98a9b89004b5c0,1900ca8acb92fbea8bf9abef9927c7fed03db7fc)`	affected	code_commit	—
`[78f768e36c065ca3f88272fcf39014782c2d4ecd,ebe5561154c823b323bd06e350b55e0b8604d851)`	affected	code_commit	—
`[4b30ae9adb047dd0a7982975ec3933c529537026,a9224862d597d0eed0a34bbb27343f703fc4113f)`	affected	code_commit	—
`[4b30ae9adb047dd0a7982975ec3933c529537026,7213256c91ed778a0997c2029c152b18dc50e4fd)`	affected	code_commit	—
`[4b30ae9adb047dd0a7982975ec3933c529537026,4df78ff02629c7729168f0696a7a2123c389818d)`	affected	code_commit	—
`c996e25df0b3282c724bb5aca434518bc08cd963`	affected	code_commit	—
`[5.15.186,5.15.209)`	affected	semver	—
`[6.1.142,6.1.175)`	affected	semver	—
`[6.6.95,6.6.142)`	affected	semver	—
`[6.12.35,6.12.92)`	affected	semver	—
`[6.15.4,6.16)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.16`	affected	semver	—
`[0,6.16)`	unaffected	semver	—
`[5.15.209,5.15.*]`	unaffected	generic	—
`[6.1.175,6.1.*]`	unaffected	generic	—
`[6.6.142,6.6.*]`	unaffected	generic	—
`[6.12.92,6.12.*]`	unaffected	generic	—
`[6.18.34,6.18.*]`	unaffected	generic	—
`[7.0.11,7.0.*]`	unaffected	generic	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a patched release that contains the CVE-2026-64032 fix.
Remove bridge ports only after disabling global multicast snooping or ensuring that per‑VLAN snooping is not enabled simultaneously; avoid configurations that could leave contexts enabled.
Apply least privileged access controls to bridge configuration management and monitor kernel logs for multicast‑related errors.

Generated by OpenCVE AI on August 5, 2026 at 02:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00125.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1900ca8acb92fbea8bf9abef9927c7fed03db7fc
https://git.kernel.org/stable/c/4df78ff02629c7729168f0696a7a2123c389818d
https://git.kernel.org/stable/c/7213256c91ed778a0997c2029c152b18dc50e4fd
https://git.kernel.org/stable/c/a9224862d597d0eed0a34bbb27343f703fc4113f
https://git.kernel.org/stable/c/ddefd1b8e5eb58933a697ab38334f0fd82e7fb8b
https://git.kernel.org/stable/c/ebe5561154c823b323bd06e350b55e0b8604d851
https://git.kernel.org/stable/c/ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70
https://lore.kernel.org/linux-cve-announce/2026071904-CVE-2026-64032-9dca@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64032
https://www.cve.org/CVERecord?id=CVE-2026-64032

History

Wed, 29 Jul 2026 01:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416 CWE-590

Wed, 22 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026071904-CVE-2026-64032-9dca@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64032 https://www.cve.org/CVERecord?id=CVE-2026-64032
Metrics	threat_severity `None`	threat_severity `Moderate`

Tue, 21 Jul 2026 22:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416 CWE-590

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix a possible use-after-free when removing a bridge port When per-VLAN multicast snooping is enabled, the bridge iterates over all the bridge ports, disables the per-port multicast context on each port and enables the per-{port, VLAN} multicast contexts instead. The reverse happens when per-VLAN multicast snooping is disabled. When global multicast snooping is enabled, the bridge iterates over all the bridge ports and enables the per-port multicast context on each port. The reverse happens when multicast snooping is disabled. The above scheme can result in a situation where both types of contexts (per-port and per-{port, VLAN}) are enabled on a single bridge port: # ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1 # ip link add name dummy1 up master br1 type dummy # ip link set dev br1 type bridge mcast_vlan_snooping 1 # ip link set dev br1 type bridge mcast_snooping 0 # ip link set dev br1 type bridge mcast_snooping 1 This is not intended and it is a problem since the commit cited below. Prior to this commit, when removing a bridge port, br_multicast_disable_port() would disable the per-port multicast context and the per-{port, VLAN} multicast contexts would get disabled when flushing VLANs. After this commit, br_multicast_disable_port() only disables the per-port multicast context if per-VLAN multicast snooping is disabled. If both types of contexts were enabled on the port when it was removed, the per-port multicast context would remain enabled when freeing the bridge port, leading to a use-after-free [1]. Fix by preventing the bridge from enabling / disabling the per-port multicast contexts when toggling global multicast snooping if per-VLAN multicast snooping is enabled. [1] ODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer_list hint: br_ip6_multicast_port_query_expired (net/bridge/br_multicast.c:1927) WARNING: lib/debugobjects.c:629 at debug_print_object+0x1b1/0x3e0, CPU#5: swapper/5/0 [...] Call Trace: <IRQ> __debug_check_no_obj_freed (lib/debugobjects.c:1116) kfree (mm/slub.c:2620 mm/slub.c:6250 mm/slub.c:6565) kobject_cleanup (lib/kobject.c:689) rcu_do_batch (kernel/rcu/tree.c:2617) rcu_core (kernel/rcu/tree.c:2869) handle_softirqs (kernel/softirq.c:622) __irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735) irq_exit_rcu (kernel/softirq.c:752) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 47) arch/x86/kernel/apic/apic.c:1061 (discriminator 47)) </IRQ>
Title		bridge: mcast: Fix a possible use-after-free when removing a bridge port
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1900ca8acb92fbea8bf9abef9927c7fed03db7fc https://git.kernel.org/stable/c/4df78ff02629c7729168f0696a7a2123c389818d https://git.kernel.org/stable/c/7213256c91ed778a0997c2029c152b18dc50e4fd https://git.kernel.org/stable/c/a9224862d597d0eed0a34bbb27343f703fc4113f https://git.kernel.org/stable/c/ddefd1b8e5eb58933a697ab38334f0fd82e7fb8b https://git.kernel.org/stable/c/ebe5561154c823b323bd06e350b55e0b8604d851 https://git.kernel.org/stable/c/ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:39:22.228Z

Updated: 2026-08-05T12:38:26.376Z

Reserved: 2026-07-19T07:54:57.028Z

Link: CVE-2026-64032

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64032 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-05T02:45:17Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object