{"id":"CVE-2026-98881","kind":"vulnerability","aliases":["CVE-2026-98881"],"related":[],"title":"Linux kernel: stale rcu_barrier in bridge code stalls network namespace cleanup","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: remove stale rcu_barrier() in br_multicast_dev_del()\n\nThis rcu_barrier() came from a time call_rcu() calls were used in\nnet/bridge/br_multicast.c.\n\nNow kfree_rcu() is there, we can remove this problematic rcu_barrier()\nwhich causes extreme RTNL pressure in many syzbot reports.\n\nINFO: task syz-executor:77945 is blocked on a mutex likely owned by task kworker/u1024:5:36537.\ntask:kworker/u1024:5 state:D stack:24616 pid:36537 tgid:36537 ppid:2      task_flags:0x4208060 flags:0x00080000 last_sleep:612797637337\nWorkqueue: netns cleanup_net\nCall Trace:\n <TASK>\n  [<ffffffff81914eaa>] context_switch+0xf2a/0x1730 kernel/sched/core.c:6483\n  [<ffffffff81201143>] __schedule+0x1133/0x43a0 kernel/sched/core.c:8411\n  [<ffffffff8120446b>] __schedule_loop kernel/sched/core.c:8514 [inline]\n  [<ffffffff8120446b>] schedule+0xab/0x260 kernel/sched/core.c:8529\n  [<ffffffff8121a093>] schedule_timeout+0xc3/0x2b0 kernel/time/sleep_timeout.c:75\n  [<ffffffff81205347>] do_wait_for_common kernel/sched/completion.c:100 [inline]\n  [<ffffffff81205347>] __wait_for_common kernel/sched/completion.c:121 [inline]\n  [<ffffffff81205347>] wait_for_common kernel/sched/completion.c:132 [inline]\n  [<ffffffff81205347>] wait_for_completion+0x2c7/0x5d0 kernel/sched/completion.c:153\n  [<ffffffff81b8f27f>] rcu_barrier+0x49f/0x620 kernel/rcu/tree.c:3888\n  [<ffffffff860091b3>] br_multicast_dev_del+0x303/0x350 net/bridge/br_multicast.c:4459\n  [<ffffffff85fb5dbc>] br_dev_uninit+0x1c/0x40 net/bridge/br_device.c:157\n  [<ffffffff8568058c>] unregister_netdevice_many_notify+0x1c1c/0x2300 net/core/dev.c:12599\n  [<ffffffff8562be43>] ops_exit_rtnl_list net/core/net_namespace.c:187 [inline]\n  [<ffffffff8562be43>] ops_undo_list+0x3d3/0x940 net/core/net_namespace.c:248","summary":"A leftover rcu_barrier() call in the Linux kernel bridge multicast teardown path blocks network namespace cleanup for long periods, holding the RTNL lock. The sources describe a stall and lock pressure rather than code execution or data theft.","severity":"unknown","cvss":null,"epss":0.00215,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bridge","containers","linux-kernel","runtime"],"not_affected_if":["no-bridge-devices"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T12:18:21+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:09+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:00:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: stale rcu_barrier in bridge code stalls network namespace cleanup","impact":"low","summary":"A leftover rcu_barrier() call in the Linux kernel bridge multicast teardown path blocks network namespace cleanup for long periods, holding the RTNL lock. The sources describe a stall and lock pressure rather than code execution or data theft.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","bridge","containers"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Denial of service through stalled network namespace cleanup and RTNL contention","analyst_note":"Find the kernel commit that removes the rcu_barrier() call and the stable branches that carry it, to give exact fixed versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-bridge-devices"],"who_is_affected":"Systems running Linux kernels that include the bridge multicast code and that create and destroy network namespaces or bridge devices often, such as container hosts. The sources do not state fixed kernel versions or which stable releases carry the change.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000639,"input_tokens":4177,"output_tokens":442,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':167C,172C,182C,188C,214C,220C,228C,235C,243C,257C '-2026':14A,17A '-98881':15A,18A '0x00080000':155C '0x4208060':153C '100':197C '121':203C '12599':246C '132':209C '153':217C '157':238C '187':252C '2':150C '24616':144C '248':260C '36537':137C,146C,148C '3888':223C '4459':231C '5':136C,140C '612797637337':158C '6483':170C '75':191C '77945':125C '8411':175C '8514':179C '8529':185C 'barrier':5A,28B,79C,87C,110C,219C 'block':38B,127C 'br':81C,224C,232C 'bridg':7A,19B,34B,75C 'call':29B,92C,94C,163C 'came':88C 'caus':112C 'cleanup':12A,41B,161C 'code':8A,59B 'common':195C,201C,207C 'complet':213C 'contain':20B 'context':165C 'cve':13A,16A 'd':142C 'data':62B 'del':84C,227C 'describ':51B 'dev':83C,226C,233C 'execut':60B 'executor':124C 'exit':248C 'extrem':113C 'flag':152C,154C 'follow':69C 'hold':45B 'info':120C 'inlin':180C,198C,204C,210C,253C 'kernel':2A,23B,33B,67C 'kernel/rcu/tree.c':222C 'kernel/sched/completion.c':196C,202C,208C,216C 'kernel/sched/core.c':169C,174C,178C,184C 'kernel/time/sleep_timeout.c':190C 'kfree':100C 'kworker/u1024':135C,139C 'last':156C 'leftov':26B 'like':131C 'linux':1A,22B,32B,66C 'linux-kernel':21B 'list':250C,256C 'lock':48B,55B 'long':43B 'loop':177C 'mani':117C,241C 'multicast':35B,82C,225C 'mutex':130C 'namespac':11A,40B 'net':74C,162C 'net/bridge/br_device.c':237C 'net/bridge/br_multicast.c':98C,230C 'net/core/dev.c':245C 'net/core/net_namespace.c':251C,259C 'netdevic':240C 'netn':160C 'network':10A,39B 'notifi':242C 'op':247C,254C 'own':132C 'path':37B 'period':44B 'pid':145C 'ppid':149C 'pressur':56B,115C 'problemat':108C 'rather':57B 'rcu':4A,27B,78C,86C,93C,101C,109C,218C 'remov':76C,106C 'report':119C 'resolv':73C 'rtnl':47B,114C,249C 'runtim':24B 'schedul':171C,176C,181C,186C 'sleep':157C 'sourc':50B 'stack':143C 'stale':3A,77C 'stall':9A,53B 'state':141C 'switch':166C 'syz':123C 'syz-executor':122C 'syzbot':118C 'task':121C,134C,138C,151C 'teardown':36B 'tgid':147C 'theft':63B 'time':91C 'timeout':187C 'trace':164C 'undo':255C 'uninit':234C 'unregist':239C 'use':96C 'vulner':70C 'wait':193C,199C,205C,211C 'workqueu':159C 'x1133/0x43a0':173C 'x1c/0x40':236C 'x1c1c/0x2300':244C 'x2c7/0x5d0':215C 'x303/0x350':229C 'x3d3/0x940':258C 'x49f/0x620':221C 'xab/0x260':183C 'xc3/0x2b0':189C 'xf2a/0x1730':168C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux kernels that include the bridge multicast code and that create and destroy network namespaces or bridge devices often, such as container hosts. The sources do not state fixed kernel versions or which stable releases carry the change.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98881","severity":null,"published_at":"2026-10-23T12:18:21+00:00","modified_at":"2026-10-23T12:18:21+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98881","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98881","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}