CVE-2026-64032

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bridge: mcast: Fix a possible use-after-free when removing a bridge port<br /> <br /> When per-VLAN multicast snooping is enabled, the bridge iterates over<br /> all the bridge ports, disables the per-port multicast context on each<br /> port and enables the per-{port, VLAN} multicast contexts instead. The<br /> reverse happens when per-VLAN multicast snooping is disabled.<br /> <br /> When global multicast snooping is enabled, the bridge iterates over all<br /> the bridge ports and enables the per-port multicast context on each<br /> port. The reverse happens when multicast snooping is disabled.<br /> <br /> The above scheme can result in a situation where both types of contexts<br /> (per-port and per-{port, VLAN}) are enabled on a single bridge port:<br /> <br /> # ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1<br /> # ip link add name dummy1 up master br1 type dummy<br /> # ip link set dev br1 type bridge mcast_vlan_snooping 1<br /> # ip link set dev br1 type bridge mcast_snooping 0<br /> # ip link set dev br1 type bridge mcast_snooping 1<br /> <br /> This is not intended and it is a problem since the commit cited below.<br /> Prior to this commit, when removing a bridge port,<br /> br_multicast_disable_port() would disable the per-port multicast context<br /> and the per-{port, VLAN} multicast contexts would get disabled when<br /> flushing VLANs.<br /> <br /> After this commit, br_multicast_disable_port() only disables the<br /> per-port multicast context if per-VLAN multicast snooping is disabled.<br /> If both types of contexts were enabled on the port when it was removed,<br /> the per-port multicast context would remain enabled when freeing the<br /> bridge port, leading to a use-after-free [1].<br /> <br /> Fix by preventing the bridge from enabling / disabling the per-port<br /> multicast contexts when toggling global multicast snooping if per-VLAN<br /> multicast snooping is enabled.<br /> <br /> [1]<br /> ODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer_list hint: br_ip6_multicast_port_query_expired (net/bridge/br_multicast.c:1927)<br /> WARNING: lib/debugobjects.c:629 at debug_print_object+0x1b1/0x3e0, CPU#5: swapper/5/0<br /> [...]<br /> Call Trace:<br /> <br /> __debug_check_no_obj_freed (lib/debugobjects.c:1116)<br /> kfree (mm/slub.c:2620 mm/slub.c:6250 mm/slub.c:6565)<br /> kobject_cleanup (lib/kobject.c:689)<br /> rcu_do_batch (kernel/rcu/tree.c:2617)<br /> rcu_core (kernel/rcu/tree.c:2869)<br /> handle_softirqs (kernel/softirq.c:622)<br /> __irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735)<br /> irq_exit_rcu (kernel/softirq.c:752)<br /> sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 47) arch/x86/kernel/apic/apic.c:1061 (discriminator 47))<br />