CVE-2026-80842

A flaw was found in the Linux kernel's bridge multicast (mcast) component. A race condition in the handling of a master VLAN's multicast context during teardown can allow a network attacker to trigger a use-after-free vulnerability. This could lead to system instability or a denial of service (DoS).

This IMPORTANT severity (Red Hat CVSS 7.0) use-after-free flaw in the Linux kernel's bridge multicast (mcast) handling affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, and Red Hat OpenShift streams. A race condition exists during teardown of a master VLAN's multicast context: when a master VLAN is deleted, __vlan_del() clears BRIDGE_VLAN_INFO_BRENTRY before calling br_vlan_put_master(), so the teardown handshake that clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock never runs for the master VLAN. The multicast context is then drained in br_multicast_ctx_deinit() and the VLAN is freed via call_rcu(), while the bridge transmit path can still see the context as enabled: an IGMP packet sent to the bridge device selects the master VLAN's multicast context in br_multicast_rcv() and re-arms its timers after they have already been stopped, causing a use-after-free (a KASAN slab-use-after-free report in the timer code). An attacker able to send IGMP traffic to a bridge device, racing that traffic against the deletion of a master VLAN, could use this flaw to make the kernel unstable or crash the system, resulting in a denial of service. Fixes are being pursued for the affected products through their respective update streams. Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present in that release, and the affectedness of Red Hat Enterprise Linux 6 is still under assessment.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.