From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
Date: Fri, 4 Sep 2026 17:53:09 +0200 [thread overview]
Message-ID: <2026090458-CVE-2026-80842-d74a@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
br_multicast_toggle_one_vlan() clears BR_VLFLAG_MCAST_ENABLED under
br->multicast_lock before stopping a VLAN's multicast context. That is
the teardown handshake: lockless readers gate on the flag through
br_multicast_ctx_should_use() -> br_multicast_ctx_vlan_disabled(), so
once it is cleared under the lock no reader can arm the context again.
For a master VLAN the handshake never runs. __vlan_del() clears
BRIDGE_VLAN_INFO_BRENTRY before calling br_vlan_put_master(), so
br_multicast_toggle_one_vlan(masterv, false) returns early on
!br_vlan_is_brentry(vlan): the flag stays set and br->multicast_lock is
never taken. br_vlan_put_master() then drains the context in
br_multicast_ctx_deinit() and frees the VLAN through call_rcu(), while a
reader still inside rcu_read_lock() sees the context as enabled and
re-arms it. The port and port-VLAN branch of the function has no
br_vlan_is_brentry() test and flips the flag under br->multicast_lock,
so it is not affected.
The reader is the bridge transmit path. For a master VLAN
br_multicast_rcv() selects brmctx = &vlan->br_mcast_ctx with
pmctx = NULL, so IGMP sent to the bridge device re-arms the context's
timers after br_multicast_ctx_deinit() has already stopped them.
BUG: KASAN: slab-use-after-free in detach_if_pending+0x412/0x4a0
Write of size 8 at addr ffff88810ac39918 by task brmc/601
__mod_timer+0x51a/0xc50
br_multicast_host_join+0x25b/0x390
__br_multicast_add_group+0x468/0x530
br_ip4_multicast_add_group+0x1a0/0x260
br_multicast_rcv+0x2cda/0x61e0
br_dev_xmit+0x6c4/0x1540
Allocated by task 610:
br_vlan_add+0x111/0xb40
br_vlan_info+0x370/0x3e0
Freed by task 0:
kfree+0x1a7/0x4f0
rcu_core+0x7dc/0x10a0
Only test br_vlan_is_brentry() when enabling, like the
br_multicast_ctx_vlan_global_disabled() test next to it. Disabling then
always clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before
br_multicast_ctx_deinit() drains the context.
The Linux kernel CVE team has assigned CVE-2026-80842 to this issue.
Affected and fixed versions
===========================
Issue introduced in 5.15 with commit 7b54aaaf53cb784411426c64482af0435f7c845e and fixed in 5.15.220 with commit 3afaaee2f972aec9059110953adb62fa3cf5c4bd
Issue introduced in 5.15 with commit 7b54aaaf53cb784411426c64482af0435f7c845e and fixed in 6.1.187 with commit 22226a2c3b90f15b0925f1464470d3baa6c5677e
Issue introduced in 5.15 with commit 7b54aaaf53cb784411426c64482af0435f7c845e and fixed in 6.6.156 with commit 7c54fd8cfbcf371a5ef50db5c53fe6e85fb76686
Issue introduced in 5.15 with commit 7b54aaaf53cb784411426c64482af0435f7c845e and fixed in 6.12.108 with commit 3a0ad4fcdfa0b7dba1876de14a12cb65c8b5ca50
Issue introduced in 5.15 with commit 7b54aaaf53cb784411426c64482af0435f7c845e and fixed in 6.18.49 with commit c069f29da72324697aa4b7cab5b3647a7d24a575
Issue introduced in 5.15 with commit 7b54aaaf53cb784411426c64482af0435f7c845e and fixed in 7.1.13 with commit 3f4752996735e0628af559aa8da1d872c2fac13b
Issue introduced in 5.15 with commit 7b54aaaf53cb784411426c64482af0435f7c845e and fixed in 7.2.3 with commit 57f94d3f4dee8b54d63cefddf1112be4656ef9e6
Issue introduced in 5.15 with commit 7b54aaaf53cb784411426c64482af0435f7c845e and fixed in 7.3-rc1 with commit 50e5c6605cc9c2dd57bd2d1b3459674d19738983
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-80842
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
net/bridge/br_multicast.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/3afaaee2f972aec9059110953adb62fa3cf5c4bd
https://git.kernel.org/stable/c/22226a2c3b90f15b0925f1464470d3baa6c5677e
https://git.kernel.org/stable/c/7c54fd8cfbcf371a5ef50db5c53fe6e85fb76686
https://git.kernel.org/stable/c/3a0ad4fcdfa0b7dba1876de14a12cb65c8b5ca50
https://git.kernel.org/stable/c/c069f29da72324697aa4b7cab5b3647a7d24a575
https://git.kernel.org/stable/c/3f4752996735e0628af559aa8da1d872c2fac13b
https://git.kernel.org/stable/c/57f94d3f4dee8b54d63cefddf1112be4656ef9e6
https://git.kernel.org/stable/c/50e5c6605cc9c2dd57bd2d1b3459674d19738983
reply other threads:[~2026-09-04 15:59 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026090458-CVE-2026-80842-d74a@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.