DEBIAN-CVE-2026-99117: Use After Free
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: don't truncate the port group walk on teardown brmulticastdisableportctx() and brmulticastdelport() walk port->mglist with hlistforeachentrysafe(). However, brmulticastfinddelpg() can also delete other entries from the same list through brmulticastfwdsrcremove() or fwddelstarexcl(). If such an entry is the iterator's saved next node, hlistdelinit() clears its ->next and terminates the walk early. The reproducer triggers this in both teardown walks, leaving port groups in the bridge mdb with a dangling ->key.port after delnbp() frees the port: BUG: KASAN: slab-use-after-free in mdbfillinfo+0x1191/0x1320 mdbfillinfo+0x1191/0x1320 brmdbdump+0x594/0xe40 rtnlmdbdump+0x1cf/0x5d0 Use hlistdelinitrcu() to unlink the group while preserving ->next. brmulticastdelpg() and the teardown walks run under br->multicastlock. The GC worker must acquire the same lock before detaching the group for destruction, so the node remains alive while the walk uses the preserved pointer. Preserving ->next means a walk can now reach a group that an earlier iteration already deleted as a side effect. That group is off mp->ports, so brmulticastfinddelpg() would fall through its port scan and hit the trailing WARNON(1). Skip such groups at the top of that helper: a port group is put on port->mglist when it is created and only unlinked when it is deleted, so hlistunhashed() identifies exactly this case.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the bridge multicast teardown implementation, use hlist_del_init_rcu() to unlink port groups while preserving ->next; skip hlist_unhashed() groups at the top of the teardown helper; and have the GC worker acquire br->multicast_lock before detaching a group for destruction. Keep br_multicast_del_pg() and the teardown walks under br->multicast_lock.