CVE-2026-98026

Received Received - Intake

Use-After-Free in Linux Kernel Bridge Multicast

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: properly convert mglist to rcu Sashiko reported a bug [1] that br_multicast_del_port_group unlists the port group not using proper rcu helper that preserves the next pointer and after that immediately frees the port group without waiting for rcu grace period. The only rcu walker of mglist is br_multicast_list_adjacent() and it turns out that function has always been buggy because mglist was never properly converted to RCU. Fix it by converting it to rcu and moving its initialization after eth_addr's. Initializing p->next can use RCU_INIT_POINTER because we have a barrier from the hlist_add_head_rcu call later, besides we're initializing an unpublished structure anyway. [1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260826014200.362304-1-littleddfu%40gmail.com

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98026

EUVD

EUVD-2026-86679

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of multicast group lists in the bridge subsystem. The issue occurs when a port group is unlisted without using the correct RCU (Read-Copy-Update) mechanism, leading to premature freeing of memory before all readers have finished accessing it. The bug affects the mglist structure, which was not properly converted to use RCU, causing potential use-after-free errors or memory corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's bridge multicast handling and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying the presence of the vulnerable code path. Commands like dmesg, journalctl, or inspecting kernel modules may help identify issues.

Impact Analysis

This vulnerability could lead to system crashes, memory corruption, or privilege escalation if exploited. Attackers might trigger the bug by sending specially crafted network traffic, causing denial-of-service conditions or unauthorized access to kernel memory. Systems running vulnerable Linux kernel versions with bridge multicast enabled are at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level Linux kernel issue related to multicast group list handling in the bridge subsystem. There is no evidence in the provided context that this flaw impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the mcast list RCU conversion issue. Monitor vendor advisories for kernel updates addressing this CVE.

Hi! I’m here to help you understand CVE-2026-98026. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70