CVE-2026-80842
Received Received - Intake

Use-After-Free in Linux Kernel Bridge Multicast

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context br_multicast_toggle_one_vlan() clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before stopping a VLAN's multicast context. That is the teardown handshake: lockless readers gate on the flag through br_multicast_ctx_should_use() -> br_multicast_ctx_vlan_disabled(), so once it is cleared under the lock no reader can arm the context again. For a master VLAN the handshake never runs. __vlan_del() clears BRIDGE_VLAN_INFO_BRENTRY before calling br_vlan_put_master(), so br_multicast_toggle_one_vlan(masterv, false) returns early on !br_vlan_is_brentry(vlan): the flag stays set and br->multicast_lock is never taken. br_vlan_put_master() then drains the context in br_multicast_ctx_deinit() and frees the VLAN through call_rcu(), while a reader still inside rcu_read_lock() sees the context as enabled and re-arms it. The port and port-VLAN branch of the function has no br_vlan_is_brentry() test and flips the flag under br->multicast_lock, so it is not affected. The reader is the bridge transmit path. For a master VLAN br_multicast_rcv() selects brmctx = &vlan->br_mcast_ctx with pmctx = NULL, so IGMP sent to the bridge device re-arms the context's timers after br_multicast_ctx_deinit() has already stopped them. BUG: KASAN: slab-use-after-free in detach_if_pending+0x412/0x4a0 Write of size 8 at addr ffff88810ac39918 by task brmc/601 __mod_timer+0x51a/0xc50 br_multicast_host_join+0x25b/0x390 __br_multicast_add_group+0x468/0x530 br_ip4_multicast_add_group+0x1a0/0x260 br_multicast_rcv+0x2cda/0x61e0 br_dev_xmit+0x6c4/0x1540 Allocated by task 610: br_vlan_add+0x111/0xb40 br_vlan_info+0x370/0x3e0 Freed by task 0: kfree+0x1a7/0x4f0 rcu_core+0x7dc/0x10a0 Only test br_vlan_is_brentry() when enabling, like the br_multicast_ctx_vlan_global_disabled() test next to it. Disabling then always clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before br_multicast_ctx_deinit() drains the context.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80842
EUVD
EUVD-2026-71292

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel *
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's bridge multicast handling. It occurs when a master VLAN's multicast context is freed while still being accessed by the bridge transmit path. The issue stems from improper synchronization where a flag controlling multicast context usage is cleared before the context is fully deinitialized, leading to a race condition that can cause memory corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's bridge multicast handling. Detection requires checking kernel logs for slab-use-after-free errors related to bridge multicast contexts. Monitor system logs for KASAN reports or kernel oops messages mentioning detach_if_pending, br_multicast_host_join, or br_multicast_rcv.

Impact Analysis

This vulnerability could cause system crashes, memory corruption, or privilege escalation if exploited. It specifically affects systems using Linux kernel bridge networking with multicast traffic. Attackers on the same network could potentially trigger this issue by sending malicious IGMP packets to the bridge device, leading to denial of service or system instability.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's bridge multicast handling that could lead to memory corruption or crashes. While it does not directly impact data protection standards like GDPR or HIPAA, such kernel-level vulnerabilities may indirectly affect compliance by compromising system stability, availability, or integrity of systems processing sensitive data.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update to a kernel version containing the fix for CVE-2026-80842. If immediate patching is not possible, disable bridge multicast functionality as a temporary workaround by setting multicast_snooping to 0 on affected bridge interfaces.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80842. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart