CVE-2024-26837

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: switchdev: Skip MDB replays of deferred events on offload

Before this change, generation of the list of MDB events to replay

would race against the creation of new group memberships, either from

the IGMP/MLD snooping logic or from user configuration.

While new memberships are immediately visible to walkers of

br->mdb_list, the notification of their existence to switchdev event

subscribers is deferred until a later point in time. So if a replay

list was generated during a time that overlapped with such a window,

it would also contain a replay of the not-yet-delivered event.

The driver would thus receive two copies of what the bridge internally

considered to be one single event. On destruction of the bridge, only

a single membership deletion event was therefore sent. As a

consequence of this, drivers which reference count memberships (at

least DSA), would be left with orphan groups in their hardware

data

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References