CVE-2026-45913
published 2026-05-27CVE-2026-45913: In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: always update mdb_n_entries for vlan contexts syzbot triggered a…
medium5.5
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: mcast: always update mdb_n_entries for vlan contexts
syzbot triggered a warning[1] about the number of mdb entries in a context.
It turned out that there are multiple ways to trigger that warning today
(some got added during the years), the root cause of the problem is that
the increase is done conditionally, and over the years these different
conditions increased so there were new ways to trigger the warning, that is
to do a decrease which wasn't paired with a previous increase.
For example one way to trigger it is with flush:
$ ip l add br0 up type bridge vlan_filtering 1 mcast_snooping 1
$ ip l add dumdum up master br0 type dummy
$ bridge mdb add dev br0 port dumdum grp 239.0.0.1 permanent vid 1
$ ip link set dev br0 down
$ ip link set dev br0 type bridge mcast_vlan_snooping 1
^^^^ this will enable snooping, but will not update mdb_n_entries
because in __br_multicast_enable_port_ctx() we check !netif_running
$ bridge mdb flush dev br0
^^^ this will trigger the warning because it will delete the pg which
we added above, which will try to decrease mdb_n_entries
Fix the problem by removing the conditional increase and always keep the
count up-to-date while the vlan exists. In order to do that we have to
first initialize it on port-vlan context creation, and then always increase
or decrease the value regardless of mcast options. To keep the current
behaviour we have to enforce the mdb limit only if the context is port's or
if the port-vlan's mcast snooping is enabled.
[1]
------------[ cut here ]------------
n == 0
WARNING: net/bridge/br_multicast.c:718 at br_multicast_port_ngroups_dec_one net/bridge/br_multicast.c:718 [inline], CPU#0: syz.4.4607/22043
WARNING: net/bridge/br_multicast.c:718 at br_multicast_port_ngroups_dec net/bridge/br_multicast.c:771 [inline], CPU#0: syz.4.4607/22043
WARNING: net/bridge/br_multicast.c:718 at br_multicast_del_pg+0x1bbe/0x1e20 net/bridge/br_multicas
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= b57e8d870d522d905720052e6fd9c3bc9bc5f6fb < d0fdad1bdd21a358cc2c85da3681ae27b86ce6ce | d0fdad1bdd21a358cc2c85da3681ae27b86ce6ce |
| linux | linux | >= b57e8d870d522d905720052e6fd9c3bc9bc5f6fb < 724a405ce0309676f1e993c173382b4c4a022beb | 724a405ce0309676f1e993c173382b4c4a022beb |
| linux | linux | >= b57e8d870d522d905720052e6fd9c3bc9bc5f6fb < fae260fc84e1eae8f590c7907e53e8768df2d986 | fae260fc84e1eae8f590c7907e53e8768df2d986 |
| linux | linux | >= b57e8d870d522d905720052e6fd9c3bc9bc5f6fb < 45525fdfd4cb612d7b414dd5cfa1f43892a7cd71 | 45525fdfd4cb612d7b414dd5cfa1f43892a7cd71 |
| linux | linux | >= b57e8d870d522d905720052e6fd9c3bc9bc5f6fb < 8b769e311a86bb9d15c5658ad283b86fc8f080a2 | 8b769e311a86bb9d15c5658ad283b86fc8f080a2 |
| linux | linux_kernel | — | — |