CVE-2026-45913

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mcast: always update mdb_n_entries for vlan contexts

syzbot triggered a warning[1] about the number of mdb entries in a context.

It turned out that there are multiple ways to trigger that warning today

(some got added during the years), the root cause of the problem is that

the increase is done conditionally, and over the years these different

conditions increased so there were new ways to trigger the warning, that is

to do a decrease which wasn't paired with a previous increase.

For example one way to trigger it is with flush:

$ ip l add br0 up type bridge vlan_filtering 1 mcast_snooping 1

$ ip l add dumdum up master br0 type dummy

$ bridge mdb add dev br0 port dumdum grp 239.0.0.1 permanent vid 1

$ ip link set dev br0 down

$ ip link set dev br0 type bridge mcast_vlan_snooping 1

^^^^ this will enable snooping, but will not update mdb_n_entries

because in __br_multicast_enable_port_ctx()

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References