CVE-2026-80842: Linux Kernel Bridge Use-After-Free Vulnerability

CVE-2026-80842 Overview

CVE-2026-80842 is a use-after-free vulnerability in the Linux kernel's network bridge multicast subsystem. The flaw resides in br_multicast_toggle_one_vlan(), which fails to clear the BR_VLFLAG_MCAST_ENABLED flag under br->multicast_lock when handling a master VLAN. As a result, br_vlan_put_master() can free the VLAN through call_rcu() while a concurrent reader in the bridge transmit path re-arms the multicast context timers. The vulnerability was resolved through multiple stable kernel commits published on 2026-09-04.

Critical Impact
A local attacker with the ability to send IGMP traffic to a bridge device can trigger a slab use-after-free in the kernel, leading to memory corruption, denial of service, or potential privilege escalation.

Affected Products

Linux kernel (mainline branches containing the bridge multicast VLAN teardown path)
Linux kernel stable branches referenced by the fix commits
Distributions shipping vulnerable bridge multicast code with VLAN filtering enabled

Discovery Timeline

2026-09-04 - CVE-2026-80842 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80842

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the Linux bridge multicast VLAN teardown path. The normal teardown handshake relies on br_multicast_toggle_one_vlan() clearing BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before stopping a VLAN's multicast context. Lockless readers gate on this flag via br_multicast_ctx_should_use() and br_multicast_ctx_vlan_disabled(), so once cleared under the lock, no reader can re-arm the context.

For master VLANs this handshake never executes. __vlan_del() clears BRIDGE_VLAN_INFO_BRENTRY before calling br_vlan_put_master(), causing br_multicast_toggle_one_vlan(masterv, false) to return early on the !br_vlan_is_brentry(vlan) check. The enabled flag remains set and the lock is never acquired. br_vlan_put_master() then drains the context in br_multicast_ctx_deinit() and frees the VLAN through call_rcu().

Root Cause

The root cause is an incorrect early-return condition in br_multicast_toggle_one_vlan(). The br_vlan_is_brentry() test was applied to both the enable and disable paths. Disabling a master VLAN whose BRENTRY flag has already been cleared skips the flag-clearing step, breaking the synchronization contract with lockless readers.

Attack Vector

The reader in question is the bridge transmit path. For a master VLAN, br_multicast_rcv() selects brmctx = &vlan->br_mcast_ctx with pmctx = NULL. IGMP packets sent to the bridge device re-arm the context's timers after br_multicast_ctx_deinit() has already stopped them. KASAN reports confirm the slab-use-after-free in detach_if_pending() triggered via __mod_timer() from br_multicast_host_join() in the br_dev_xmit() path. Refer to the Linux Kernel Commit 3afaaee for the upstream fix.

// No verified exploit code is available for CVE-2026-80842.
// See kernel commits referenced in External References for patch details.

Detection Methods for CVE-2026-80842

Indicators of Compromise

KASAN reports showing slab-use-after-free in detach_if_pending with writes to freed VLAN multicast context memory.
Kernel oops or panic traces originating from __mod_timer called by br_multicast_host_join under br_dev_xmit.
Unexpected bridge device restarts or network interruptions following VLAN reconfiguration on hosts running vulnerable kernels.

Detection Strategies

Enable KASAN on test kernels to surface use-after-free access in bridge multicast paths during VLAN teardown.
Audit running kernel versions across fleet inventory and correlate against the fixed stable branch commits.
Monitor kernel logs for BUG: KASAN entries referencing br_multicast_* or detach_if_pending symbols.

Monitoring Recommendations

Aggregate kernel ring buffer output into a centralized log store and alert on bridge subsystem crashes.
Track VLAN add and delete operations on bridge devices, particularly on hosts serving containerized or virtualized workloads.
Baseline expected IGMP traffic volumes to identify anomalous multicast activity aimed at bridge devices.

How to Mitigate CVE-2026-80842

Immediate Actions Required

Apply the upstream kernel patches referenced in the External References to all affected systems.
Prioritize hosts using bridge devices with VLAN filtering and multicast snooping enabled, such as container hosts and hypervisors.
Reboot patched systems to load the fixed kernel image and validate bridge functionality afterward.

Patch Information

The fix modifies br_multicast_toggle_one_vlan() to test br_vlan_is_brentry() only on the enable path, matching the neighboring br_multicast_ctx_vlan_global_disabled() check. On disable, the function always clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before br_multicast_ctx_deinit() drains the context. The patch is available across stable branches through commits including Linux Kernel Commit 22226a2, Linux Kernel Commit 3a0ad4f, Linux Kernel Commit 3f47529, Linux Kernel Commit 50e5c66, Linux Kernel Commit 57f94d3, Linux Kernel Commit 7c54fd8, and Linux Kernel Commit c069f29.

Workarounds

Disable multicast snooping on bridge devices where feasible using ip link set dev <bridge> type bridge mcast_snooping 0.
Avoid dynamic add and delete cycles of master VLANs on production bridges until the kernel is patched.
Restrict local access to reduce the pool of principals capable of injecting IGMP traffic and manipulating bridge VLAN state.

bash

# Disable multicast snooping on a bridge as a temporary workaround
ip link set dev br0 type bridge mcast_snooping 0

# Verify current setting
cat /sys/class/net/br0/bridge/multicast_snooping