CVE-2026-80842

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mcast: fix use-after-free of a master VLAN's multicast context

br_multicast_toggle_one_vlan() clears BR_VLFLAG_MCAST_ENABLED under

br->multicast_lock before stopping a VLAN's multicast context. That is

the teardown handshake: lockless readers gate on the flag through

br_multicast_ctx_should_use() -> br_multicast_ctx_vlan_disabled(), so

once it is cleared under the lock no reader can arm the context again.

For a master VLAN the handshake never runs. __vlan_del() clears

BRIDGE_VLAN_INFO_BRENTRY before calling br_vlan_put_master(), so

br_multicast_toggle_one_vlan(masterv, false) returns early on

!br_vlan_is_brentry(vlan): the flag stays set and br->multicast_lock is

never taken. br_vlan_put_master() then drains the context in

br_multicast_ctx_deinit() and frees the VLAN through call_rcu(), while a

reader still inside rcu_read_lock() sees the context as enabled and

re-arms it. The port and port-VLAN bra

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References