Executive brief
A vulnerability in the Linux kernel's bridge networking code allows a use-after-free condition when handling multicast traffic on bridge VLANs. An attacker with network access could trigger this by sending IGMP multicast packets to a bridge device, potentially causing a denial of service or system crash. This affects systems using bridge networking with multicast support enabled.
Technical details
The vulnerability exists in the br_multicast_toggle_one_vlan() function, where the multicast context teardown handshake for master VLANs does not properly synchronize flag clearing with the multicast lock. When a master VLAN is deleted via __vlan_del(), the BR_VLFLAG_MCAST_ENABLED flag is not cleared under the multicast lock before the context is drained and freed via RCU. A lockless reader in the bridge transmit path (br_multicast_rcv()) can observe the context as still enabled and re-arm its timers after they have been stopped by br_multicast_ctx_deinit(), causing a write to freed memory. The fix involves testing br_vlan_is_brentry() only during enable operations and ensuring the flag is always cleared under the multicast lock before context deinitialization. The attack vector requires network-level access to send IGMP packets to the bridge device.
Affected products
- Linux Linux kernel <parameter>unspecified
Timeline
- 2026-09-04: disclosed