From mboxrd@z Thu Jan 1 00:00:00 1970 From: AL-KERNEL To: kernel-cve@kernelcve.org Subject: [CVE-2026-98026][MODERATE REGULAR] net: bridge: mcast: properly convert mglist to rcu [ Upstream Date: Fri, 25 Sep 2026 10:25:30 -0400 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-AL-KERNEL-CVE: CVE-2026-98026 X-AL-KERNEL-Priority: MODERATE REGULAR X-AL-KERNEL-Severity: MODERATE REGULAR X-AL-KERNEL-Base-Severity: MODERATE X-AL-KERNEL-KPANIC: NO X-AL-KERNEL-ActionableScore: 3 X-AL-KERNEL-ActionableScore-Lower: unknown X-AL-KERNEL-Commit: 98247c8264d2076f81fa114bdfa2c2271953ac7c List-Id: CVE: CVE-2026-98026 Priority: MODERATE REGULAR AL-KERNEL base severity: MODERATE KPANIC flag: NO Patch: net: bridge: mcast: properly convert mglist to rcu [ Upstream Commit: 98247c8264d2076f81fa114bdfa2c2271953ac7c Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=98247c8264d2076f81fa114bdfa2c2271953ac7c Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98026 Analysis date: Fri, 25 Sep 2026 10:25:30 -0400 ActionableScore: 3 ActionableScore lower bound: unknown Actionable bucket: Borderline / manual review recommended Manual review required: YES Summary: No one-sentence report phrase was found. ====================================================================== ABOUT THIS REPORT ====================================================================== The original Linux kernel CVE announcement for CVE-2026-98026 is available here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98026 The original announcement does not normally provide a security severity estimate, CVSS assessment, or enough information to determine whether the reported kernel bug represents a practically relevant security issue. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. It combines an autonomous classifier with LLM-assisted technical analysis and a separate ActionableScore mechanism. The purpose of this report is to prioritize Linux kernel CVEs before manual review, identify cases that require prompt investigation, and support automatic closure of issues that are unlikely to have meaningful security impact. Published priority for this report: MODERATE REGULAR Manual review required: YES A detailed explanation of the methodology and priority rules is included at the end of this message. ====================================================================== AL-KERNEL CLASSIFICATION RESULT ====================================================================== CVE-2026-98026 MODERATE https://www.kernelcve.org/list/?q=CVE-2026-98026 CHECK WITH IMPACT FROM ORIG NN MODERATE Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H';*CWE-416;CWE-362;*CWE-664;Other CVSS 'AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H';BEST CVSS score: '7.5';DESCR 'A use after free can occur in the Linux bridge multicast mglist because a port group may be removed and freed while br_multicast_list_adjacent is traversing the list under RCU protection. An adjacent network attacker may be able to influence bridge multicast state through multicast traffic or membership activity while a concurrent port group deletion occurs. For the CVSS the PR:N value is used because no local account or local code execution on the target is required when the attacker can access the affected Layer 2 multicast domain. The race condition makes exploitation timing dependent and requires AC:H. The confirmed impact is at least denial of service through a kernel crash. The stale pointer UAF may also provide confidentiality or integrity impact in a worst case memory corruption scenario and should be reviewed manually. This issue is relevant only on systems using Linux bridge multicast snooping or multicast forwarding. It is normally reachable from a local Layer 2 network rather than from the public Internet.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Borderline / manual review recommended (with actual score 3) YES INIT SIMPLEFIX IMPROVEONLY INCREASED_TO_MODERATE7_BASED_ON_GUESSCVSS DECREASED_TO_MODERATEREG_BASED_ON_ACTIONABLESCORELESSTHAN4 NO NO checked ====================================================================== ACTIONABLESCORE ANALYSIS ====================================================================== ActionableScore=3 PrimitiveClass=CLASS_B RealUAF=YES HostAdminRequired=UNKNOWN NamespaceScopedPrivilege=UNKNOWN ImportantCandidate=NO ManualReview=RECOMMENDED AutoDowngradeAllowed=YES 1. ActionableScore * Raw conservative score: 3 * Conservative score: 3 * Raw paranoid score: 3 * Paranoid score: 3 * Final recommended bucket: **Borderline / manual review recommended**:: No floor or cap was applied. 2. Signal breakdown * +2 Real UAF or active lifetime violation. The patch establishes that `net_bridge_port_group` objects in `mglist` can be removed and immediately freed while `br_multicast_list_adjacent()` still traverses that list as an RCU reader. The conversion from `hlist_del_init()` and `kfree()` to `hlist_del_init_rcu()` and `kfree_rcu()` directly fixes an RCU lifetime violation. * +1 Plausible kernel crash or DoS. An RCU reader can dereference or traverse a port-group list entry after the original object lifetime has ended. A stale list/object access can cause an Oops or kernel crash. Not awarded: * +2 Direct remote network reachability was not awarded. The affected code is in bridge multicast handling, but the supplied patch does not establish that untrusted multicast traffic alone can cause both the relevant list traversal and concurrent port-group deletion without additional bridge state or control-plane activity. * +1 Attacker-influenced active-object lifetime manipulation was not awarded. The patch does not show that one attacker can repeatedly create, remove, and reclaim the affected `net_bridge_port_group` objects. * +1 Structured stale-object exploitation leverage was not awarded. The stale use is an RCU list traversal, but no controlled object replacement, attacker-controlled post-free contents, callback dispatch, pointer reuse, or meaningful post-free field consumption is established. * +2 Strong exploitation leverage was not awarded. No controlled reclaim, arbitrary write, directed write, type confusion, refcount takeover, information disclosure, or privilege-escalation chain is shown. * Confidentiality and integrity points were not awarded. The patch establishes a lifetime violation, but does not establish a disclosure path or unauthorized modification primitive. * No race penalty was applied. The bug is concurrent, but the supplied material does not prove a uniquely narrow or externally uncontrollable one-shot timing window. * No host-administrator penalty was applied. The complete privilege boundary for creation, removal, and traversal of the affected bridge multicast state is not established. * No niche-subsystem penalty was applied. Linux bridge multicast functionality is not inherently rare, although actual reachability depends on bridge multicast configuration. 3. Reachability analysis The affected object belongs to Linux bridge multicast state. The immediate vulnerable sequence requires an RCU traversal by `br_multicast_list_adjacent()` to overlap with `br_multicast_del_port_group()` removing and freeing the same port group. The supplied patch supports an RCU-reader versus deletion race, but does not provide the relevant callers or establish which actor can reliably cause both operations. An adjacent Layer 2 attacker may influence multicast membership or traffic in some bridge deployments, but the evidence does not establish that network traffic alone triggers the complete vulnerable lifetime sequence. Host-admin-equivalent privilege is not positively established, so `HostAdminRequired=UNKNOWN`. Conversely, below-host-admin reachability is also not established, so it cannot be set to `NO`. The patch does not establish that all required operations are available from an attacker-controlled network namespace, therefore `NamespaceScopedPrivilege=UNKNOWN`. The issue is relevant only when bridge multicast handling is enabled and the vulnerable adjacent-list traversal is exercised. No special hardware, boot parameter, firmware prerequisite, or explicit privileged setup requirement is shown in the supplied evidence. 4. Primitive and severity interpretation The exact primitive is a real RCU lifetime violation. A `net_bridge_port_group` remains potentially reachable by an RCU list walker after deletion because the old code removes it without the RCU list helper and immediately calls `kfree()` without waiting for an RCU grace period. This is an active structured-object UAF rather than fixed stale storage. However, the supplied context only establishes stale list traversal and potential dereference after free. It does not establish controlled reuse of the freed allocation, attacker-controlled replacement contents, an active callback or operations-table dereference, arbitrary read or write, disclosure, or a security-boundary bypass. There is no concrete repeated release, `put`, refcount decrement, or second free through the same dangling reference. This is therefore not a repeated-lifetime-mutation case. The correct primitive classification is `CLASS_B`. The demonstrated consequence is kernel instability or DoS through stale-object access. Privilege escalation, confidentiality impact, and integrity impact remain theoretical possibilities of a generic kernel UAF and are not established by this patch. `ImportantCandidate=NO` because the known stale use is limited to RCU list traversal and no meaningful exploit leverage beyond a crash is demonstrated. `AutoDowngradeAllowed=YES` because this is currently a constrained Class B lifetime bug without demonstrated controlled reclaim, repeated refcount mutation, post-free attacker control, or boundary bypass. Manual review remains recommended to inspect the actual callers of `br_multicast_list_adjacent()` and bridge multicast state-management paths. Likely operational severity is Moderate. It should be prioritized higher if downstream analysis proves that an unprivileged adjacent attacker can reliably drive group deletion and list traversal, or if stale traversal consumes attacker-influenced replacement state. 5. One-sentence report phrase A Linux bridge multicast RCU lifetime bug can free a multicast port-group object while `br_multicast_list_adjacent()` still traverses it, potentially causing a kernel crash or denial of service. 6. Manual review recommendation MANUAL CHECK RECOMMENDED The patch establishes a genuine RCU use-after-free, but the supplied context does not establish complete attacker reachability or exploitation leverage beyond a crash. 7. Call-site confidence Call-site confidence: medium ====================================================================== UPSTREAM PATCH SUMMARY ====================================================================== Patch: net: bridge: mcast: properly convert mglist to rcu [ Upstream Commit: 98247c8264d2076f81fa114bdfa2c2271953ac7c Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=98247c8264d2076f81fa114bdfa2c2271953ac7c Changed files: net/bridge/br_multicast.c Diff excerpt: Not included in this email. See the upstream URL for the full patch. Full patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=98247c8264d2076f81fa114bdfa2c2271953ac7c ====================================================================== DETAILED REPORT METHODOLOGY ====================================================================== The original Linux kernel CVE announcement for CVE-2026-98026 can be found here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98026 The original CVE announcement normally does not include a security-level estimate. In particular, it may not contain a CVSS assessment, an impact level, or enough information to determine whether the reported bug is a practically relevant security issue. One purpose of this parallel CVE list is to provide that missing technical and prioritization information. The original goal of the AL-KERNEL project was to prioritize Linux kernel CVE analysis automatically before manual review. The system can also help identify non-security issues that may be suitable for automatic closure. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. The first analysis stage combines an autonomous classifier with additional LLM-based analysis. The autonomous classifier runs locally on a CPU and is based on a backpropagation neural network. Together, these mechanisms produce a technical vulnerability description, identify likely weakness types, estimate CVSS severity, and provide input for ActionableScore. Two CVSS estimates are retained because incomplete kernel vulnerability information often permits more than one defensible interpretation: Conservative CVSS vector: AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H The Best / paranoid CVSS vector: AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H The Best / paranoid CVSS score: 7.5 The conservative vector represents a lower-impact interpretation. The Best/paranoid vector intentionally represents a plausible upper-bound interpretation and should not automatically be treated as demonstrated real-world impact. CVSS may also need to be adjusted for a particular Linux deployment, because actual reachability, privileges, enabled kernel configuration, hardware, namespaces, exposed device nodes, and other environmental conditions can differ significantly between systems. A separate ActionableScore mechanism evaluates practical remediation urgency. Its analysis may include reachability, attack prerequisites, subsystem exposure, memory-corruption characteristics, denial-of-service reliability, and possible confidentiality, integrity, or privilege-escalation impact. Conservative ActionableScore: unknown Paranoid ActionableScore: 3 The final base severity is taken directly from the second tab-separated field of the AL-KERNEL classification result. ActionableScore does not replace or independently override that final AL-KERNEL decision, and if ActionableScore adjusted impact level of ALKERNEL, then you would see self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7. For an AL-KERNEL result of MODERATE, this report uses the following additional presentation split: ActionableScore below 5 -> MODERATE REGULAR ActionableScore 5 or more -> MODERATE 7.0 The distinction between MODERATE REGULAR and MODERATE 7.0 makes it possible to identify Moderate issues that should receive manual analysis and fixes before lower-priority MODERATE REGULAR issues. In many cases, MODERATE REGULAR fixes may wait for a later rebase or routine update. There is one override in which MODERATE REGULAR becomes MODERATE 7.0 even when the ActionableScore is below 5. When the AL-KERNEL result contains the KPANIC flag, a MODERATE result is always presented as MODERATE 7.0. The KPANIC flag selected with few regexps without usage of AI at all, so it helps to detect cases when Kernel Crash happens and similar (to filter False-Negative results from the LLM usage). KPANIC indicates that a reliable kernel crash, kernel panic, or similarly serious kernel availability impact was identified by the classification workflow. AL-KERNEL base severity for this report: MODERATE KPANIC detected for this report: NO Published priority for this report (same as in Subject): MODERATE REGULAR These results are intended to support engineering triage. They are machine-generated estimates, and cases marked for manual review should be validated by a human security engineer before final disposition. For more info read docs linked from here: https://kernelcve.org/ (and you can submit you own patch there to generate such a report for non-existant CVE-id yet). Note that in many cases this AI tool selects higher severity, than real is (means you can expect Importants instead of Moderate 7.0 or Moderates 7.0 instead of regular Moderates). If you see such cases, please use reply email interface to add additional manual analyses info to this particular CVE. And please, please, let me know when you see Lows instead of Importants or Important instead of Low (because particular for such cases I need to tune this AI tool to make it better for this one and next similar). My contact email for such notifications is alexanjelausa@gmail.com (and both send reply to CVE record itself too and see "reply" button below for howto reply).