{"id":"CVE-2026-99117","kind":"vulnerability","aliases":["CVE-2026-99117"],"related":[],"title":"Linux kernel bridge multicast: port group teardown can use freed memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mcast: don't truncate the port group walk on teardown\n\n__br_multicast_disable_port_ctx() and br_multicast_del_port() walk\nport->mglist with hlist_for_each_entry_safe(). However,\nbr_multicast_find_del_pg() can also delete other entries from the same\nlist through br_multicast_fwd_src_remove() or __fwd_del_star_excl().\n\nIf such an entry is the iterator's saved next node, hlist_del_init()\nclears its ->next and terminates the walk early. The reproducer triggers\nthis in both teardown walks, leaving port groups in the bridge mdb with\na dangling ->key.port after del_nbp() frees the port:\n\n  BUG: KASAN: slab-use-after-free in __mdb_fill_info+0x1191/0x1320\n   __mdb_fill_info+0x1191/0x1320\n   br_mdb_dump+0x594/0xe40\n   rtnl_mdb_dump+0x1cf/0x5d0\n\nUse hlist_del_init_rcu() to unlink the group while preserving ->next.\nbr_multicast_del_pg() and the teardown walks run under\nbr->multicast_lock. The GC worker must acquire the same lock before\ndetaching the group for destruction, so the node remains alive while\nthe walk uses the preserved pointer.\n\nPreserving ->next means a walk can now reach a group that an earlier\niteration already deleted as a side effect. That group is off mp->ports,\nso br_multicast_find_del_pg() would fall through its port scan and hit\nthe trailing WARN_ON(1). Skip such groups at the top of that helper: a\nport group is put on port->mglist when it is created and only unlinked\nwhen it is deleted, so hlist_unhashed() identifies exactly this case.","summary":"A flaw in the Linux kernel bridge multicast code lets the port group list walk stop early during port teardown, leaving entries that point at a freed port. A reader of the bridge multicast database can then touch freed memory, which the sources describe as a KASAN use-after-free.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-bridge","linux-kernel","runtime"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T11:17:31+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","triaged_at":"2026-10-28T11:37:37+00:00","updated_at":"2026-10-28T11:37:37+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-28T11:37:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel bridge multicast: port group teardown can use freed memory","impact":"medium","summary":"A flaw in the Linux kernel bridge multicast code lets the port group list walk stop early during port teardown, leaving entries that point at a freed port. A reader of the bridge multicast database can then touch freed memory, which the sources describe as a KASAN use-after-free.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","linux-bridge"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; use-after-free in kernel memory, impact not stated","analyst_note":"Fetch the NVD entry and the linked upstream kernel fix commit to get the affected and fixed kernel versions, severity and whether an unprivileged user can trigger it.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000571,"input_tokens":3825,"output_tokens":377,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':201C,206C,211C,216C '-2026':13A,16A '-99117':14A,17A '1':313C 'acquir':247C 'aliv':261C 'alreadi':283C 'also':124C 'br':98C,104C,118C,133C,208C,230C,240C,296C 'bridg':3A,20B,31B,57B,87C,178C 'bug':190C 'case':348C 'clear':157C 'code':33B 'creat':334C 'ctx':102C 'cve':12A,15A 'dangl':182C 'databas':59B 'del':106C,121C,140C,155C,185C,220C,232C,299C 'delet':125C,284C,341C 'describ':68B 'destruct':256C 'detach':252C 'disabl':100C 'dump':210C,215C 'earli':41B,164C 'earlier':281C 'effect':288C 'entri':46B,115C,127C,146C 'exact':346C 'excl':142C 'fall':302C 'fill':199C,204C 'find':120C,298C 'flaw':26B 'follow':81C 'free':75B,187C,196C 'freed':10A,51B,63B 'fwd':135C,139C 'gc':244C 'group':6A,37B,94C,175C,226C,254C,278C,290C,316C,325C 'helper':322C 'hit':308C 'hlist':112C,154C,219C,343C 'howev':117C 'identifi':345C 'info':200C,205C 'init':156C,221C 'iter':149C,282C 'kasan':71B,191C 'kernel':2A,23B,30B,79C 'key.port':183C 'leav':45B,173C 'let':34B 'linux':1A,19B,22B,29B,78C 'linux-bridg':18B 'linux-kernel':21B 'list':38B,131C 'lock':242C,250C 'mcast':88C 'mdb':179C,198C,203C,209C,214C 'mean':271C 'memori':11A,64B 'mglist':110C,330C 'mp':293C 'multicast':4A,32B,58B,99C,105C,119C,134C,231C,241C,297C 'must':246C 'nbp':186C 'net':86C 'next':152C,159C,229C,270C 'node':153C,259C 'pg':122C,233C,300C 'point':48B 'pointer':268C 'port':5A,36B,43B,52B,93C,101C,107C,109C,174C,189C,294C,305C,324C,329C 'preserv':228C,267C,269C 'put':327C 'rcu':222C 'reach':276C 'reader':54B 'remain':260C 'remov':137C 'reproduc':166C 'resolv':85C 'rtnl':213C 'run':238C 'runtim':24B 'safe':116C 'save':151C 'scan':306C 'side':287C 'skip':314C 'slab':193C 'slab-use-after-fre':192C 'sourc':67B 'src':136C 'star':141C 'stop':40B 'teardown':7A,44B,97C,171C,236C 'termin':161C 'top':319C 'touch':62B 'trail':310C 'trigger':167C 'truncat':91C 'unhash':344C 'unlink':224C,337C 'use':9A,73B,194C,218C,265C 'use-after-fre':72B 'vulner':82C 'walk':39B,95C,108C,163C,172C,237C,264C,273C 'warn':311C 'worker':245C 'would':301C 'x1191/0x1320':202C,207C 'x1cf/0x5d0':217C 'x594/0xe40':212C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99117","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99117","severity":null,"published_at":"2026-10-28T11:17:31+00:00","modified_at":"2026-10-28T11:17:31+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","fetched_at":"2026-10-28T11:32:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}