{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2026-64032", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-64032", "idYear": 2026, "status": "PUBLISHED", "publishedAt": "2026-07-19T15:39:22.228Z", "updatedAt": "2026-10-19T20:28:09.740Z", "importedAt": "2026-10-24T01:58:25.636Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "bridge: mcast: Fix a possible use-after-free when removing a bridge port", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: mcast: Fix a possible use-after-free when removing a bridge port\n\nWhen per-VLAN multicast snooping is enabled, the bridge iterates over\nall the bridge ports, disables the per-port multicast context on each\nport and enables the per-{port, VLAN} multicast contexts instead. The\nreverse happens when per-VLAN multicast snooping is disabled.\n\nWhen global multicast snooping is enabled, the bridge iterates over all\nthe bridge ports and enables the per-port multicast context on each\nport. The reverse happens when multicast snooping is disabled.\n\nThe above scheme can result in a situation where both types of contexts\n(per-port and per-{port, VLAN}) are enabled on a single bridge port:\n\n # ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1\n # ip link add name dummy1 up master br1 type dummy\n # ip link set dev br1 type bridge mcast_vlan_snooping 1\n # ip link set dev br1 type bridge mcast_snooping 0\n # ip link set dev br1 type bridge mcast_snooping 1\n\nThis is not intended and it is a problem since the commit cited below.\nPrior to this commit, when removing a bridge port,\nbr_multicast_disable_port() would disable the per-port multicast context\nand the per-{port, VLAN} multicast contexts would get disabled when\nflushing VLANs.\n\nAfter this commit, br_multicast_disable_port() only disables the\nper-port multicast context if per-VLAN multicast snooping is disabled.\nIf both types of contexts were enabled on the port when it was removed,\nthe per-port multicast context would remain enabled when freeing the\nbridge port, leading to a use-after-free [1].\n\nFix by preventing the bridge from enabling / disabling the per-port\nmulticast contexts when toggling global multicast snooping if per-VLAN\nmulticast snooping is enabled.\n\n[1]\nODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer_list hint: br_ip6_multicast_port_query_expired (net/bridge/br_multicast.c:1927)\nWARNING: lib/debugobjects.c:629 at debug_print_object+0x1b1/0x3e0, CPU#5: swapper/5/0\n[...]\nCall Trace:\n\n__debug_check_no_obj_freed (lib/debugobjects.c:1116)\nkfree (mm/slub.c:2620 mm/slub.c:6250 mm/slub.c:6565)\nkobject_cleanup (lib/kobject.c:689)\nrcu_do_batch (kernel/rcu/tree.c:2617)\nrcu_core (kernel/rcu/tree.c:2869)\nhandle_softirqs (kernel/softirq.c:622)\n__irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735)\nirq_exit_rcu (kernel/softirq.c:752)\nsysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 47) arch/x86/kernel/apic/apic.c:1061 (discriminator 47))\n", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "410a033bfa8c7daefbae0225c836693db2149ec1", "status": "affected", "versionType": "git", "lessThan": "ddefd1b8e5eb58933a697ab38334f0fd82e7fb8b" }, { "version": "c6d16eab122744df698f18b47cf771945cd55066", "status": "affected", "versionType": "git", "lessThan": "ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70" }, { "version": "b4c83b37490d61cfdd62a2b29e98a9b89004b5c0", "status": "affected", "versionType": "git", "lessThan": "1900ca8acb92fbea8bf9abef9927c7fed03db7fc" }, { "version": "78f768e36c065ca3f88272fcf39014782c2d4ecd", "status": "affected", "versionType": "git", "lessThan": "ebe5561154c823b323bd06e350b55e0b8604d851" }, { "version": "4b30ae9adb047dd0a7982975ec3933c529537026", "status": "affected", "versionType": "git", "lessThan": "a9224862d597d0eed0a34bbb27343f703fc4113f" }, { "version": "4b30ae9adb047dd0a7982975ec3933c529537026", "status": "affected", "versionType": "git", "lessThan": "7213256c91ed778a0997c2029c152b18dc50e4fd" }, { "version": "4b30ae9adb047dd0a7982975ec3933c529537026", "status": "affected", "versionType": "git", "lessThan": "4df78ff02629c7729168f0696a7a2123c389818d" }, { "version": "c996e25df0b3282c724bb5aca434518bc08cd963", "status": "affected", "versionType": "git" }, { "version": "5.15.186", "status": "affected", "versionType": "semver", "lessThan": "5.15.209" }, { "version": "6.1.142", "status": "affected", "versionType": "semver", "lessThan": "6.1.175" }, { "version": "6.6.95", "status": "affected", "versionType": "semver", "lessThan": "6.6.142" }, { "version": "6.12.35", "status": "affected", "versionType": "semver", "lessThan": "6.12.92" }, { "version": "6.15.4", "status": "affected", "versionType": "semver", "lessThan": "6.16" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "6.16", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "6.16" }, { "version": "5.15.209", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.1.175", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.6.142", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.92", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.18.34", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.18.*" }, { "version": "7.0.11", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "7.0.*" }, { "version": "7.1", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }