Description
In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mcast: don't truncate the port group walk on teardown

__br_multicast_disable_port_ctx() and br_multicast_del_port() walk
port->mglist with hlist_for_each_entry_safe(). However,
br_multicast_find_del_pg() can also delete other entries from the same
list through br_multicast_fwd_src_remove() or __fwd_del_star_excl().

If such an entry is the iterator's saved next node, hlist_del_init()
clears its ->next and terminates the walk early. The reproducer triggers
this in both teardown walks, leaving port groups in the bridge mdb with
a dangling ->key.port after del_nbp() frees the port:

BUG: KASAN: slab-use-after-free in __mdb_fill_info+0x1191/0x1320
__mdb_fill_info+0x1191/0x1320
br_mdb_dump+0x594/0xe40
rtnl_mdb_dump+0x1cf/0x5d0

Use hlist_del_init_rcu() to unlink the group while preserving ->next.
br_multicast_del_pg() and the teardown walks run under
br->multicast_lock. The GC worker must acquire the same lock before
detaching the group for destruction, so the node remains alive while
the walk uses the preserved pointer.

Preserving ->next means a walk can now reach a group that an earlier
iteration already deleted as a side effect. That group is off mp->ports,
so br_multicast_find_del_pg() would fall through its port scan and hit
the trailing WARN_ON(1). Skip such groups at the top of that helper: a
port group is put on port->mglist when it is created and only unlinked
when it is deleted, so hlist_unhashed() identifies exactly this case.
Published: 2026-10-28
Score: n/a
EPSS: n/a
KEV: No
Impact: Kernel crash and denial of service due to use‑after‑free in multicast bridge
Action: Patch
AI Analysis

Impact

A use‑after‑free flaw in Linux kernel multicast bridge logic occurs when a bridge port is torn down. While walking a linked list of port groups, concurrently deleting an entry can prematurely terminate the traversal, leaving a stale pointer and triggering a KASAN error. The result is a kernel panic or loss of service on the affected system.

Affected Systems

All Linux kernel builds that contain the buggy multicast bridge code and have not applied the fix that replaces the list traversal with safer unlinking via hlist_del_init_rcu and additional guard checks are affected. No particular kernel version range is specified, so any distribution that has not yet integrated the commit may be vulnerable.

Risk and Exploitability

The CVSS score is missing, EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The immediate consequence is a kernel crash or denial of service. The likely attack vector is manipulation of bridge multicast teardown operations, but the precise conditions required are not specified in the advisory. Exploitation likelihood remains uncertain based on the available data.

Generated by OpenCVE AI on October 28, 2026 at 12:43 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply a kernel update that contains the commit correcting the multicast list traversal
  • If a kernel update is not available, disable or remove multicast bridge functionality from the system until a patch is applied
  • Reboot the system or restart network bridge services after patching to clear any lingering corrupted port group references

Generated by OpenCVE AI on October 28, 2026 at 12:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Wed, 28 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: don't truncate the port group walk on teardown __br_multicast_disable_port_ctx() and br_multicast_del_port() walk port->mglist with hlist_for_each_entry_safe(). However, br_multicast_find_del_pg() can also delete other entries from the same list through br_multicast_fwd_src_remove() or __fwd_del_star_excl(). If such an entry is the iterator's saved next node, hlist_del_init() clears its ->next and terminates the walk early. The reproducer triggers this in both teardown walks, leaving port groups in the bridge mdb with a dangling ->key.port after del_nbp() frees the port: BUG: KASAN: slab-use-after-free in __mdb_fill_info+0x1191/0x1320 __mdb_fill_info+0x1191/0x1320 br_mdb_dump+0x594/0xe40 rtnl_mdb_dump+0x1cf/0x5d0 Use hlist_del_init_rcu() to unlink the group while preserving ->next. br_multicast_del_pg() and the teardown walks run under br->multicast_lock. The GC worker must acquire the same lock before detaching the group for destruction, so the node remains alive while the walk uses the preserved pointer. Preserving ->next means a walk can now reach a group that an earlier iteration already deleted as a side effect. That group is off mp->ports, so br_multicast_find_del_pg() would fall through its port scan and hit the trailing WARN_ON(1). Skip such groups at the top of that helper: a port group is put on port->mglist when it is created and only unlinked when it is deleted, so hlist_unhashed() identifies exactly this case.
Title net: bridge: mcast: don't truncate the port group walk on teardown
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-28T10:34:33.874Z

Reserved: 2026-09-25T10:25:14.392Z

Link: CVE-2026-99117

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T11:17:31.253

Modified: 2026-10-28T11:17:31.253

Link: CVE-2026-99117

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T12:45:16Z

Weaknesses