Use-after-free in Linux kernel - CVE-2026-64032
Published: July 20, 2026
Vulnerability identifier: #VU138610
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-64032
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the bridge multicast handling in net/bridge/br_multicast.c when removing a bridge port after toggling multicast snooping states. A local user can trigger bridge port state transitions that leave a multicast context enabled on a freed bridge port to cause a denial of service.
The issue occurs when per-VLAN multicast snooping is enabled and global multicast snooping is toggled in a way that leaves both per-port and per-{port, VLAN} multicast contexts enabled on the same port.
How to mitigate CVE-2026-64032
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/1900ca8acb92fbea8bf9abef9927c7fed03db7fc
- https://git.kernel.org/stable/c/4df78ff02629c7729168f0696a7a2123c389818d
- https://git.kernel.org/stable/c/7213256c91ed778a0997c2029c152b18dc50e4fd
- https://git.kernel.org/stable/c/a9224862d597d0eed0a34bbb27343f703fc4113f
- https://git.kernel.org/stable/c/ddefd1b8e5eb58933a697ab38334f0fd82e7fb8b
- https://git.kernel.org/stable/c/ebe5561154c823b323bd06e350b55e0b8604d851
- https://git.kernel.org/stable/c/ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70