CVE-2026-64032
Received Received - Intake

Use-After-Free in Linux Kernel Bridge Multicast

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix a possible use-after-free when removing a bridge port When per-VLAN multicast snooping is enabled, the bridge iterates over all the bridge ports, disables the per-port multicast context on each port and enables the per-{port, VLAN} multicast contexts instead. The reverse happens when per-VLAN multicast snooping is disabled. When global multicast snooping is enabled, the bridge iterates over all the bridge ports and enables the per-port multicast context on each port. The reverse happens when multicast snooping is disabled. The above scheme can result in a situation where both types of contexts (per-port and per-{port, VLAN}) are enabled on a single bridge port: # ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1 # ip link add name dummy1 up master br1 type dummy # ip link set dev br1 type bridge mcast_vlan_snooping 1 # ip link set dev br1 type bridge mcast_snooping 0 # ip link set dev br1 type bridge mcast_snooping 1 This is not intended and it is a problem since the commit cited below. Prior to this commit, when removing a bridge port, br_multicast_disable_port() would disable the per-port multicast context and the per-{port, VLAN} multicast contexts would get disabled when flushing VLANs. After this commit, br_multicast_disable_port() only disables the per-port multicast context if per-VLAN multicast snooping is disabled. If both types of contexts were enabled on the port when it was removed, the per-port multicast context would remain enabled when freeing the bridge port, leading to a use-after-free [1]. Fix by preventing the bridge from enabling / disabling the per-port multicast contexts when toggling global multicast snooping if per-VLAN multicast snooping is enabled. [1] ODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer_list hint: br_ip6_multicast_port_query_expired (net/bridge/br_multicast.c:1927) WARNING: lib/debugobjects.c:629 at debug_print_object+0x1b1/0x3e0, CPU#5: swapper/5/0 [...] Call Trace: <IRQ> __debug_check_no_obj_freed (lib/debugobjects.c:1116) kfree (mm/slub.c:2620 mm/slub.c:6250 mm/slub.c:6565) kobject_cleanup (lib/kobject.c:689) rcu_do_batch (kernel/rcu/tree.c:2617) rcu_core (kernel/rcu/tree.c:2869) handle_softirqs (kernel/softirq.c:622) __irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735) irq_exit_rcu (kernel/softirq.c:752) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 47) arch/x86/kernel/apic/apic.c:1061 (discriminator 47)) </IRQ>

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64032
EUVD
EUVD-2026-45605

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel *
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the bridge multicast snooping functionality. When per-VLAN multicast snooping is enabled and then disabled, followed by re-enabling global multicast snooping, both per-port and per-{port, VLAN} multicast contexts can remain active on a bridge port. This leads to a situation where removing the port triggers a use-after-free error because the per-port context is not properly disabled before freeing the port.

Detection Guidance

This vulnerability is specific to Linux kernel bridge multicast snooping functionality. Detection requires checking kernel logs for use-after-free errors related to bridge multicast contexts. Monitor system logs for ODEBUG or kernel panic messages mentioning br_ip6_multicast_port_query_expired or similar bridge multicast functions.

Impact Analysis

This vulnerability can cause system instability or crashes due to the use-after-free error. It may lead to kernel panics, data corruption, or unauthorized access if exploited. Systems using Linux kernel bridge multicast snooping features are particularly at risk.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's bridge multicast snooping functionality. It does not directly relate to data privacy or security controls typically addressed by GDPR or HIPAA. Compliance impact would depend on whether the affected system is used in a regulated environment, but the vulnerability itself is not a direct violation of these standards.

Mitigation Strategies

Apply the Linux kernel patch that fixes this issue. Update to a kernel version containing the fix for bridge multicast snooping. If immediate patching isn't possible, disable bridge multicast snooping features by setting mcast_snooping=0 on affected bridge interfaces until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64032. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart