PT-2026-61349 · Linux · Linux

CVE-2026-64032 · Published 2026-07-19 · Updated 2026-07-19

Mitre

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

bridge: mcast: Fix a possible use-after-free when removing a bridge port

When per-VLAN multicast snooping is enabled, the bridge iterates over all the bridge ports, disables the per-port multicast context on each port and enables the per-{port, VLAN} multicast contexts instead. The reverse happens when per-VLAN multicast snooping is disabled.

When global multicast snooping is enabled, the bridge iterates over all the bridge ports and enables the per-port multicast context on each port. The reverse happens when multicast snooping is disabled.

The above scheme can result in a situation where both types of contexts (per-port and per-{port, VLAN}) are enabled on a single bridge port:

ip link add name br1 up type bridge mcast snooping 1 mcast querier 1 vlan filtering 1

ip link add name dummy1 up master br1 type dummy

ip link set dev br1 type bridge mcast vlan snooping 1

ip link set dev br1 type bridge mcast snooping 0

ip link set dev br1 type bridge mcast snooping 1

This is not intended and it is a problem since the commit cited below. Prior to this commit, when removing a bridge port, br multicast disable port() would disable the per-port multicast context and the per-{port, VLAN} multicast contexts would get disabled when flushing VLANs.

After this commit, br multicast disable port() only disables the per-port multicast context if per-VLAN multicast snooping is disabled. If both types of contexts were enabled on the port when it was removed, the per-port multicast context would remain enabled when freeing the bridge port, leading to a use-after-free [1].

Fix by preventing the bridge from enabling / disabling the per-port multicast contexts when toggling global multicast snooping if per-VLAN multicast snooping is enabled.

[1] ODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer list hint: br ip6 multicast port query expired (net/bridge/br multicast.c:1927) WARNING: lib/debugobjects.c:629 at debug print object+0x1b1/0x3e0, CPU#5: swapper/5/0 [...] Call Trace: debug check no obj freed (lib/debugobjects.c:1116) kfree (mm/slub.c:2620 mm/slub.c:6250 mm/slub.c:6565) kobject cleanup (lib/kobject.c:689) rcu do batch (kernel/rcu/tree.c:2617) rcu core (kernel/rcu/tree.c:2869) handle softirqs (kernel/softirq.c:622) irq exit rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735) irq exit rcu (kernel/softirq.c:752) sysvec apic timer interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 47) arch/x86/kernel/apic/apic.c:1061 (discriminator 47))

Fix

Related Identifiers

CVE-2026-64032

Affected Products

Linux

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-64032 · Security Note
• https://git.kernel.org/stable/c/4df78ff02629c7729168f0696a7a2123c389818d · Note
• https://git.kernel.org/stable/c/a9224862d597d0eed0a34bbb27343f703fc4113f · Note
• https://git.kernel.org/stable/c/ddefd1b8e5eb58933a697ab38334f0fd82e7fb8b · Note
• https://git.kernel.org/stable/c/ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70 · Note
• https://git.kernel.org/stable/c/7213256c91ed778a0997c2029c152b18dc50e4fd · Note
• https://git.kernel.org/stable/c/1900ca8acb92fbea8bf9abef9927c7fed03db7fc · Note
• https://git.kernel.org/stable/c/ebe5561154c823b323bd06e350b55e0b8604d851 · Note