{"id":"CVE-2026-64032","revision":"4f6d4b2a48d34b38b438da2f146677e5","records":[{"revision":"4f6d4b2a48d34b38b438da2f146677e5","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64032","aliases":[],"title":"bridge: mcast: Fix a possible use-after-free when removing a bridge port","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: mcast: Fix a possible use-after-free when removing a bridge port\n\nWhen per-VLAN multicast snooping is enabled, the bridge iterates over\nall the bridge ports, disables the per-port multicast context on each\nport and enables the per-{port, VLAN} multicast contexts instead. The\nreverse happens when per-VLAN multicast snooping is disabled.\n\nWhen global multicast snooping is enabled, the bridge iterates over all\nthe bridge ports and enables the per-port multicast context on each\nport. The reverse happens when multicast snooping is disabled.\n\nThe above scheme can result in a situation where both types of contexts\n(per-port and per-{port, VLAN}) are enabled on a single bridge port:\n\n # ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1\n # ip link add name dummy1 up master br1 type dummy\n # ip link set dev br1 type bridge mcast_vlan_snooping 1\n # ip link set dev br1 type bridge mcast_snooping 0\n # ip link set dev br1 type bridge mcast_snooping 1\n\nThis is not intended and it is a problem since the commit cited below.\nPrior to this commit, when removing a bridge port,\nbr_multicast_disable_port() would disable the per-port multicast context\nand the per-{port, VLAN} multicast contexts would get disabled when\nflushing VLANs.\n\nAfter this commit, br_multicast_disable_port() only disables the\nper-port multicast context if per-VLAN multicast snooping is disabled.\nIf both types of contexts were enabled on the port when it was removed,\nthe per-port multicast context would remain enabled when freeing the\nbridge port, leading to a use-after-free [1].\n\nFix by preventing the bridge from enabling / disabling the per-port\nmulticast contexts when toggling global multicast snooping if per-VLAN\nmulticast snooping is enabled.\n\n[1]\nODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer_list hint: br_ip6_multicast_port_query_expired (net/bridge/br_multicast.c:1927)\nWARNING: lib/debugobjects.c:629 at debug_print_object+0x1b1/0x3e0, CPU#5: swapper/5/0\n[...]\nCall Trace:\n\n__debug_check_no_obj_freed (lib/debugobjects.c:1116)\nkfree (mm/slub.c:2620 mm/slub.c:6250 mm/slub.c:6565)\nkobject_cleanup (lib/kobject.c:689)\nrcu_do_batch (kernel/rcu/tree.c:2617)\nrcu_core (kernel/rcu/tree.c:2869)\nhandle_softirqs (kernel/softirq.c:622)\n__irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735)\nirq_exit_rcu (kernel/softirq.c:752)\nsysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 47) arch/x86/kernel/apic/apic.c:1061 (discriminator 47))\n","state":0,"publishedAt":"2026-07-19T15:39:22.228+00:00","modifiedAt":"2026-10-19T20:28:09.74+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/bridge/br_multicast.c\"\n ],\n \"versions\": [\n {\n \"version\": \"410a033bfa8c7daefbae0225c836693db2149ec1\",\n \"lessThan\": \"ddefd1b8e5eb58933a697ab38334f0fd82e7fb8b\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"c6d16eab122744df698f18b47cf771945cd55066\",\n \"lessThan\": \"ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"b4c83b37490d61cfdd62a2b29e98a9b89004b5c0\",\n \"lessThan\": \"1900ca8acb92fbea8bf9abef9927c7fed03db7fc\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"78f768e36c065ca3f88272fcf39014782c2d4ecd\",\n \"lessThan\": \"ebe5561154c823b323bd06e350b55e0b8604d851\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"4b30ae9adb047dd0a7982975ec3933c529537026\",\n \"lessThan\": \"a9224862d597d0eed0a34bbb27343f703fc4113f\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"4b30ae9adb047dd0a7982975ec3933c529537026\",\n \"lessThan\": \"7213256c91ed778a0997c2029c152b18dc50e4fd\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"4b30ae9adb047dd0a7982975ec3933c529537026\",\n \"lessThan\": \"4df78ff02629c7729168f0696a7a2123c389818d\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"c996e25df0b3282c724bb5aca434518bc08cd963\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"5.15.186\",\n \"lessThan\": \"5.15.209\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.142\",\n \"lessThan\": \"6.1.175\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.95\",\n \"lessThan\": \"6.6.142\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.35\",\n \"lessThan\": \"6.12.92\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.15.4\",\n \"lessThan\": \"6.16\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/bridge/br_multicast.c\"\n ],\n \"versions\": [\n {\n \"version\": \"6.16\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"6.16\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.209\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.175\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.142\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.92\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.34\",\n \"lessThanOrEqual\": \"6.18.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.0.11\",\n \"lessThanOrEqual\": \"7.0.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.1\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/ddefd1b8e5eb58933a697ab38334f0fd82e7fb8b","https://git.kernel.org/stable/c/ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70","https://git.kernel.org/stable/c/1900ca8acb92fbea8bf9abef9927c7fed03db7fc","https://git.kernel.org/stable/c/ebe5561154c823b323bd06e350b55e0b8604d851","https://git.kernel.org/stable/c/a9224862d597d0eed0a34bbb27343f703fc4113f","https://git.kernel.org/stable/c/7213256c91ed778a0997c2029c152b18dc50e4fd","https://git.kernel.org/stable/c/4df78ff02629c7729168f0696a7a2123c389818d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64032","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64032","identifiers":["CVE-2026-64032"]},"retained":false,"historicalAffected":[]}],"coverage":[]}