{"id":"CVE-2026-98881","revision":null,"records":[{"revision":"28218bc6c16e429ca634cd155b06583c","observedAt":"2026-10-23T16:01:20.601+00:00","statement":{"source":"cve-program","id":"CVE-2026-98881","aliases":[],"title":"net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: remove stale rcu_barrier() in br_multicast_dev_del()\n\nThis rcu_barrier() came from a time call_rcu() calls were used in\nnet/bridge/br_multicast.c.\n\nNow kfree_rcu() is there, we can remove this problematic rcu_barrier()\nwhich causes extreme RTNL pressure in many syzbot reports.\n\nINFO: task syz-executor:77945 is blocked on a mutex likely owned by task kworker/u1024:5:36537.\ntask:kworker/u1024:5 state:D stack:24616 pid:36537 tgid:36537 ppid:2      task_flags:0x4208060 flags:0x00080000 last_sleep:612797637337\nWorkqueue: netns cleanup_net\nCall Trace:\n <TASK>\n  [<ffffffff81914eaa>] context_switch+0xf2a/0x1730 kernel/sched/core.c:6483\n  [<ffffffff81201143>] __schedule+0x1133/0x43a0 kernel/sched/core.c:8411\n  [<ffffffff8120446b>] __schedule_loop kernel/sched/core.c:8514 [inline]\n  [<ffffffff8120446b>] schedule+0xab/0x260 kernel/sched/core.c:8529\n  [<ffffffff8121a093>] schedule_timeout+0xc3/0x2b0 kernel/time/sleep_timeout.c:75\n  [<ffffffff81205347>] do_wait_for_common kernel/sched/completion.c:100 [inline]\n  [<ffffffff81205347>] __wait_for_common kernel/sched/completion.c:121 [inline]\n  [<ffffffff81205347>] wait_for_common kernel/sched/completion.c:132 [inline]\n  [<ffffffff81205347>] wait_for_completion+0x2c7/0x5d0 kernel/sched/completion.c:153\n  [<ffffffff81b8f27f>] rcu_barrier+0x49f/0x620 kernel/rcu/tree.c:3888\n  [<ffffffff860091b3>] br_multicast_dev_del+0x303/0x350 net/bridge/br_multicast.c:4459\n  [<ffffffff85fb5dbc>] br_dev_uninit+0x1c/0x40 net/bridge/br_device.c:157\n  [<ffffffff8568058c>] unregister_netdevice_many_notify+0x1c1c/0x2300 net/core/dev.c:12599\n  [<ffffffff8562be43>] ops_exit_rtnl_list net/core/net_namespace.c:187 [inline]\n  [<ffffffff8562be43>] ops_undo_list+0x3d3/0x940 net/core/net_namespace.c:248","state":0,"publishedAt":"2026-10-23T11:37:32.327+00:00","modifiedAt":"2026-10-23T11:37:32.327+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bridge/br_multicast.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n                            \"lessThan\": \"35f9f11740515a10b084adfb1ce691351f2452ab\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n                            \"lessThan\": \"0443f6aac6bf6a91e406273fdda11497cef6ad07\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n                            \"lessThan\": \"ac0e823a228f94ad9d7a3d876cc07e59a7afb806\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n                            \"lessThan\": \"f0018acf0b66f93a292667c9a9c2a26c570cf270\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n                            \"lessThan\": \"372ee8fbe0f796031c60f676ec90f0788c26523d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n                            \"lessThan\": \"39679927fa7aaf4601119f7234342d1b5d4f6f84\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n                            \"lessThan\": \"25ae123db10ba9ab890b56bcdb0a4363aee8529a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.10.271\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.15.222\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.1.189\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.6.158\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.12.111\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.18.53\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bridge/br_multicast.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/35f9f11740515a10b084adfb1ce691351f2452ab","https://git.kernel.org/stable/c/0443f6aac6bf6a91e406273fdda11497cef6ad07","https://git.kernel.org/stable/c/ac0e823a228f94ad9d7a3d876cc07e59a7afb806","https://git.kernel.org/stable/c/f0018acf0b66f93a292667c9a9c2a26c570cf270","https://git.kernel.org/stable/c/372ee8fbe0f796031c60f676ec90f0788c26523d","https://git.kernel.org/stable/c/39679927fa7aaf4601119f7234342d1b5d4f6f84","https://git.kernel.org/stable/c/25ae123db10ba9ab890b56bcdb0a4363aee8529a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98881","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98881","identifiers":["CVE-2026-98881"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-24T10:27:30.8908525+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-24T10:27:30.8908525+00:00","lastSuccessAt":"2026-10-24T10:27:31.1285633+00:00","error":null,"lastVerifiedAt":"2026-10-24T10:27:31.1285641+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-9b3cad78792c7367da03684feab05819ddebc4d137048bdbbdabdbb4d2879391-c6a8234687801ee57ab2aeb77d20947f334a6cc2941ea8b25213d5a7dcebf0ce","complete":true,"records":413884,"lastAttemptAt":"2026-10-24T10:27:30.7016219+00:00","lastSuccessAt":"2026-10-24T10:27:30.6836858+00:00","error":null,"lastVerifiedAt":"2026-10-24T10:27:30.7016219+00:00","snapshotPublishedAt":"2026-10-24T10:24:24+00:00","importing":false,"stagedRecords":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-24T10:27:30.8908525+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-24T10:27:30.8908525+00:00","lastSuccessAt":"2026-10-24T10:27:31.3689689+00:00","error":null,"lastVerifiedAt":"2026-10-24T10:27:31.3689698+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-24T10:27:30.7587662+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-24T10:27:30.7587662+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0}]}