UBUNTU-CVE-2026-80842: Use After Free
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context brmulticasttoggleonevlan() clears BRVLFLAGMCASTENABLED under br->multicastlock before stopping a VLAN's multicast context. That is the teardown handshake: lockless readers gate on the flag through brmulticastctxshoulduse() -> brmulticastctxvlandisabled(), so once it is cleared under the lock no reader can arm the context again. For a master VLAN the handshake never runs. vlandel() clears BRIDGEVLANINFOBRENTRY before calling brvlanputmaster(), so brmulticasttoggleonevlan(masterv, false) returns early on !brvlanisbrentry(vlan): the flag stays set and br->multicastlock is never taken. brvlanputmaster() then drains the context in brmulticastctxdeinit() and frees the VLAN through callrcu(), while a reader still inside rcureadlock() sees the context as enabled and re-arms it. The port and port-VLAN branch of the function has no brvlanisbrentry() test and flips the flag under br->multicastlock, so it is not affected. The reader is the bridge transmit path. For a master VLAN brmulticastrcv() selects brmctx = &vlan->brmcastctx with pmctx = NULL, so IGMP sent to the bridge device re-arms the context's timers after brmulticastctxdeinit() has already stopped them. BUG: KASAN: slab-use-after-free in detachifpending+0x412/0x4a0 Write of size 8 at addr ffff88810ac39918 by task brmc/601 modtimer+0x51a/0xc50 brmulticasthostjoin+0x25b/0x390 brmulticastaddgroup+0x468/0x530 brip4multicastaddgroup+0x1a0/0x260 brmulticastrcv+0x2cda/0x61e0 brdevxmit+0x6c4/0x1540 Allocated by task 610: brvlanadd+0x111/0xb40 brvlaninfo+0x370/0x3e0 Freed by task 0: kfree+0x1a7/0x4f0 rcucore+0x7dc/0x10a0 Only test brvlanisbrentry() when enabling, like the brmulticastctxvlanglobaldisabled() test next to it. Disabling then always clears BRVLFLAGMCASTENABLED under br->multicastlock before brmulticastctxdeinit() drains the context.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1119.126~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1125.134~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1124.133~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1120.130~20.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-202.212~20.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1113.117~20.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1114.120~20.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-197.207~20.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1070.72~20.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1116.122~20.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1113.117~20.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-202.212 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1119.126 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1125.134 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 5.15.0-1124.133 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1120.130 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1115.121 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.15.0-1102.110 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1113.117 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1114.120 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1111.116 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-197.207 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 5.15.0-1114.115 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 5.15.0-1070.72 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-igxto a version that resolves this vulnerability.Fixed in 5.15.0-1059.59 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1116.122 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.15.0-1103.105 - Upgrade
Upgrade
ubuntu/linux-intel-iot-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1111.115 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1118.127 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1119.126+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1125.134+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-202.212+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1120.130+fips1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Fix br_multicast_toggle_one_vlan() so br_vlan_is_brentry(vlan) is tested only when enabling; when disabling, clear BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before calling br_multicast_ctx_deinit(), preventing readers from re-arming a master VLAN multicast context during teardown.
Event History
Frequently Asked Questions
Which bridge VLAN configurations are affected?
The issue affects master VLANs whose multicast context is being disabled or torn down. The port and port-VLAN path is not affected because it clears the multicast-enabled flag while holding br->multicast_lock.
What race leads to the use-after-free?
During deletion of a master VLAN, the multicast-enabled flag can remain set because the teardown handshake returns early. A bridge transmit-path reader holding rcu_read_lock() can then treat the context as enabled and re-arm it after the context has been drained and the VLAN scheduled for RCU freeing.