CVE-2026-64032

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bridge: mcast: Fix a possible use-after-free when removing a bridge port

When per-VLAN multicast snooping is enabled, the bridge iterates over

all the bridge ports, disables the per-port multicast context on each

port and enables the per-{port, VLAN} multicast contexts instead. The

reverse happens when per-VLAN multicast snooping is disabled.

When global multicast snooping is enabled, the bridge iterates over all

the bridge ports and enables the per-port multicast context on each

port. The reverse happens when multicast snooping is disabled.

The above scheme can result in a situation where both types of contexts

(per-port and per-{port, VLAN}) are enabled on a single bridge port:

# ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1

# ip link add name dummy1 up master br1 type dummy

# ip link set dev br1 type bridge mcast_vlan_snooping 1

# ip link set dev br1 type bridge mcast

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References