CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context

CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mcast: fix use-after-free of a master VLAN's multicast context

br_multicast_toggle_one_vlan() clears BR_VLFLAG_MCAST_ENABLED under
br->multicast_lock before stopping a VLAN's multicast context.  That is
the teardown handshake: lockless readers gate on the flag through
br_multicast_ctx_should_use() -> br_multicast_ctx_vlan_disabled(), so
once it is cleared under the lock no reader can arm the context again.

For a master VLAN the handshake never runs.  __vlan_del() clears
BRIDGE_VLAN_INFO_BRENTRY before calling br_vlan_put_master(), so
br_multicast_toggle_one_vlan(masterv, false) returns early on
!br_vlan_is_brentry(vlan): the flag stays set and br->multicast_lock is
never taken.  br_vlan_put_master() then drains the context in
br_multicast_ctx_deinit() and frees the VLAN through call_rcu(), while a
reader still inside rcu_read_lock() sees the context as enabled and
re-arms it.  The port and port-VLAN branch of the function has no
br_vlan_is_brentry() test and flips the flag under br->multicast_lock,
so it is not affected.

The reader is the bridge transmit path.  For a master VLAN
br_multicast_rcv() selects brmctx = &vlan->br_mcast_ctx with
pmctx = NULL, so IGMP sent to the bridge device re-arms the context's
timers after br_multicast_ctx_deinit() has already stopped them.

  BUG: KASAN: slab-use-after-free in detach_if_pending+0x412/0x4a0
  Write of size 8 at addr ffff88810ac39918 by task brmc/601
   __mod_timer+0x51a/0xc50
   br_multicast_host_join+0x25b/0x390
   __br_multicast_add_group+0x468/0x530
   br_ip4_multicast_add_group+0x1a0/0x260
   br_multicast_rcv+0x2cda/0x61e0
   br_dev_xmit+0x6c4/0x1540
  Allocated by task 610:
   br_vlan_add+0x111/0xb40
   br_vlan_info+0x370/0x3e0
  Freed by task 0:
   kfree+0x1a7/0x4f0
   rcu_core+0x7dc/0x10a0

Only test br_vlan_is_brentry() when enabling, like the
br_multicast_ctx_vlan_global_disabled() test next to it.  Disabling then
always clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before
br_multicast_ctx_deinit() drains the context.

The Linux kernel CVE team has assigned CVE-2026-80842 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15 with commit 7b54aaaf53cb784411426c64482af0435f7c845e and fixed in 5.15.220 with commit 3afaaee2f972aec9059110953adb62fa3cf5c4bd
	Issue introduced in 5.15 with commit 7b54aaaf53cb784411426c64482af0435f7c845e and fixed in 6.1.187 with commit 22226a2c3b90f15b0925f1464470d3baa6c5677e
	Issue introduced in 5.15 with commit 7b54aaaf53cb784411426c64482af0435f7c845e and fixed in 6.6.156 with commit 7c54fd8cfbcf371a5ef50db5c53fe6e85fb76686
	Issue introduced in 5.15 with commit 7b54aaaf53cb784411426c64482af0435f7c845e and fixed in 6.12.108 with commit 3a0ad4fcdfa0b7dba1876de14a12cb65c8b5ca50
	Issue introduced in 5.15 with commit 7b54aaaf53cb784411426c64482af0435f7c845e and fixed in 6.18.49 with commit c069f29da72324697aa4b7cab5b3647a7d24a575
	Issue introduced in 5.15 with commit 7b54aaaf53cb784411426c64482af0435f7c845e and fixed in 7.1.13 with commit 3f4752996735e0628af559aa8da1d872c2fac13b
	Issue introduced in 5.15 with commit 7b54aaaf53cb784411426c64482af0435f7c845e and fixed in 7.2.3 with commit 57f94d3f4dee8b54d63cefddf1112be4656ef9e6
	Issue introduced in 5.15 with commit 7b54aaaf53cb784411426c64482af0435f7c845e and fixed in 7.3-rc1 with commit 50e5c6605cc9c2dd57bd2d1b3459674d19738983

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-80842
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/bridge/br_multicast.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3afaaee2f972aec9059110953adb62fa3cf5c4bd
	https://git.kernel.org/stable/c/22226a2c3b90f15b0925f1464470d3baa6c5677e
	https://git.kernel.org/stable/c/7c54fd8cfbcf371a5ef50db5c53fe6e85fb76686
	https://git.kernel.org/stable/c/3a0ad4fcdfa0b7dba1876de14a12cb65c8b5ca50
	https://git.kernel.org/stable/c/c069f29da72324697aa4b7cab5b3647a7d24a575
	https://git.kernel.org/stable/c/3f4752996735e0628af559aa8da1d872c2fac13b
	https://git.kernel.org/stable/c/57f94d3f4dee8b54d63cefddf1112be4656ef9e6
	https://git.kernel.org/stable/c/50e5c6605cc9c2dd57bd2d1b3459674d19738983