CVE-2026-64032: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64032 Overview

CVE-2026-64032 is a use-after-free vulnerability in the Linux kernel's bridge multicast (br_multicast) subsystem. The flaw occurs when per-VLAN multicast snooping is enabled and global multicast snooping is toggled off and back on. Under this sequence, both per-port and per-{port, VLAN} multicast contexts remain active on the same bridge port. When the bridge port is later removed, br_multicast_disable_port() fails to disable the per-port context, leaving a stale timer_list object referenced after the bridge port is freed. Successful exploitation can lead to kernel memory corruption, denial of service, or local privilege escalation.

Critical Impact
A local attacker with CAP_NET_ADMIN can trigger a kernel use-after-free by toggling bridge multicast snooping configuration, resulting in memory corruption and potential privilege escalation.

Affected Products

Linux kernel versions containing the per-VLAN multicast snooping feature prior to the fix
Linux distributions shipping affected upstream kernel branches
Systems using bridge networking with mcast_vlan_snooping enabled

Discovery Timeline

2026-07-19 - CVE-2026-64032 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64032

Vulnerability Analysis

The vulnerability resides in the Linux kernel bridge multicast subsystem (net/bridge/br_multicast.c). Linux bridges support two multicast snooping modes: per-port and per-{port, VLAN}. When per-VLAN multicast snooping is enabled, the bridge iterates over all bridge ports, disables the per-port multicast context, and enables per-{port, VLAN} contexts. The reverse operation runs when per-VLAN snooping is disabled.

A logic gap between the per-port and per-VLAN state machines allows both context types to become simultaneously enabled on a single bridge port. This occurs after enabling VLAN multicast snooping, disabling global multicast snooping, then re-enabling global multicast snooping. The regression traces to a prior commit that made br_multicast_disable_port() skip per-port context teardown when per-VLAN snooping is active.

Root Cause

The root cause is a state synchronization flaw between two overlapping multicast contexts. br_multicast_disable_port() only tears down the per-port context when per-VLAN multicast snooping is disabled. When both contexts remain enabled at port removal time, the per-port context's active timer_list (used by br_ip6_multicast_port_query_expired) survives past the kfree() of its containing object. The kernel debug objects subsystem detects this as a free of an active timer_list, confirming the use-after-free condition [CWE-416].

Attack Vector

Exploitation requires local access with network administration privileges (CAP_NET_ADMIN). An attacker performs the following sequence: create a bridge with mcast_snooping and vlan_filtering enabled, add a port, enable mcast_vlan_snooping, disable then re-enable mcast_snooping, and remove the bridge port. The port removal path frees the bridge port structure while an armed multicast query timer still references it. Subsequent timer expiration or RCU callback processing triggers the use-after-free, corrupting kernel memory. Skilled attackers can leverage this primitive to escalate privileges to root.

See the upstream fix at Linux Kernel Commit 1900ca8 for the reference implementation of the state synchronization fix.

Detection Methods for CVE-2026-64032

Indicators of Compromise

Kernel ODEBUG warnings referencing br_ip6_multicast_port_query_expired and free active (active state 0) object in dmesg or syslog.
Kernel oops or panic traces originating from __debug_check_no_obj_freed during rcu_do_batch softirq processing.
Unexpected ip link set ... type bridge mcast_snooping toggling events in audit logs from non-administrative sessions.

Detection Strategies

Monitor kernel logs for debug_print_object warnings tied to bridge multicast timer objects.
Audit netlink bridge configuration changes, particularly rapid toggling of mcast_snooping and mcast_vlan_snooping attributes.
Correlate bridge port additions and removals with subsequent kernel warnings or crashes in the same time window.

Monitoring Recommendations

Enable CONFIG_DEBUG_OBJECTS_TIMERS in test environments to surface bridge multicast timer misuse early.
Ship kernel ring buffer messages to a centralized log platform and alert on br_multicast and ODEBUG string matches.
Track processes invoking ip link or bridge commands with elevated capabilities against a baseline of expected administrators.

How to Mitigate CVE-2026-64032

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the vendor advisories as soon as distribution updates become available.
Restrict CAP_NET_ADMIN to trusted administrators and remove it from unprivileged user namespaces where feasible.
Inventory hosts using Linux bridges with mcast_vlan_snooping enabled and prioritize them for patching.

Patch Information

The Linux kernel maintainers resolved the flaw by preventing the bridge from enabling or disabling per-port multicast contexts when toggling global multicast snooping if per-VLAN multicast snooping is already enabled. Fixes are available across stable branches in the following commits: Linux Kernel Commit 1900ca8, Linux Kernel Commit 4df78ff, Linux Kernel Commit 7213256, Linux Kernel Commit a922486, Linux Kernel Commit ddefd1b, Linux Kernel Commit ebe5561, and Linux Kernel Commit ed3b69e.

Workarounds

Disable mcast_vlan_snooping on affected bridges until the kernel patch is applied.
Avoid toggling mcast_snooping at runtime on bridges where per-VLAN multicast snooping is enabled.
Deny unprivileged user namespace creation via sysctl -w kernel.unprivileged_userns_clone=0 on distributions that expose this control.

bash

# Configuration example: disable VLAN multicast snooping as a temporary mitigation
sudo ip link set dev br1 type bridge mcast_vlan_snooping 0

# Verify current bridge multicast settings
ip -d link show dev br1 | grep -E 'mcast_snooping|mcast_vlan_snooping'

# Restrict unprivileged user namespaces to limit CAP_NET_ADMIN abuse
sudo sysctl -w kernel.unprivileged_userns_clone=0