[CVE-2026-98026][MODERATE REGULAR] net: bridge: mcast: properly convert mglist to rcu [ Upstream

[CVE-2026-98026][MODERATE REGULAR] net: bridge: mcast: properly convert mglist to rcu [ Upstream

[AL-KERNEL]

CVE: CVE-2026-98026
Priority: MODERATE REGULAR
AL-KERNEL base severity: MODERATE
KPANIC flag: NO
Patch: net: bridge: mcast: properly convert mglist to rcu [ Upstream
Commit: 98247c8264d2076f81fa114bdfa2c2271953ac7c
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=98247c8264d2076f81fa114bdfa2c2271953ac7c
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98026
Analysis date: Fri, 25 Sep 2026 10:25:30 -0400
ActionableScore: 3
ActionableScore lower bound: unknown
Actionable bucket: Borderline / manual review recommended
Manual review required: YES

Summary:
No one-sentence report phrase was found.

======================================================================
ABOUT THIS REPORT
======================================================================

The original Linux kernel CVE announcement for CVE-2026-98026 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98026

The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.

The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.

Published priority for this report: MODERATE REGULAR
Manual review required: YES

A detailed explanation of the methodology and priority rules is included
at the end of this message.

======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================

CVE-2026-98026	MODERATE	https://www.kernelcve.org/list/?q=CVE-2026-98026 CHECK WITH IMPACT FROM ORIG NN MODERATE	Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H';*CWE-416;CWE-362;*CWE-664;Other CVSS 'AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H';BEST CVSS score: '7.5';DESCR 'A use after free can occur in the Linux bridge multicast mglist because a port group may be removed and freed while br_multicast_list_adjacent is traversing the list under RCU protection. An adjacent network attacker may be able to influence bridge multicast state through multicast traffic or membership activity while a concurrent port group deletion occurs. For the CVSS the PR:N value is used because no local account or local code execution on the target is required when the attacker can access the affected Layer 2 multicast domain. The race condition makes exploitation timing dependent and requires AC:H. The confirmed impact is at least denial of service through a kernel crash. The stale pointer UAF may also provide confidentiality or integrity impact in a worst case memory corruption scenario and should be reviewed manually. This issue is relevant only on systems using Linux bridge multicast snooping or multicast forwarding. It is normally reachable from a local Layer 2 network rather than from the public Internet.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Borderline / manual review recommended (with actual score 3)	YES	INIT SIMPLEFIX IMPROVEONLY  INCREASED_TO_MODERATE7_BASED_ON_GUESSCVSS DECREASED_TO_MODERATEREG_BASED_ON_ACTIONABLESCORELESSTHAN4	NO	NO	checked

======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================

ActionableScore=3
PrimitiveClass=CLASS_B
RealUAF=YES
HostAdminRequired=UNKNOWN
NamespaceScopedPrivilege=UNKNOWN
ImportantCandidate=NO
ManualReview=RECOMMENDED
AutoDowngradeAllowed=YES

1. ActionableScore

* Raw conservative score: 3
* Conservative score: 3
* Raw paranoid score: 3
* Paranoid score: 3
* Final recommended bucket: **Borderline / manual review recommended**::

No floor or cap was applied.

2. Signal breakdown

* +2 Real UAF or active lifetime violation. The patch establishes that `net_bridge_port_group` objects in `mglist` can be removed and immediately freed while `br_multicast_list_adjacent()` still traverses that list as an RCU reader. The conversion from `hlist_del_init()` and `kfree()` to `hlist_del_init_rcu()` and `kfree_rcu()` directly fixes an RCU lifetime violation.
* +1 Plausible kernel crash or DoS. An RCU reader can dereference or traverse a port-group list entry after the original object lifetime has ended. A stale list/object access can cause an Oops or kernel crash.

Not awarded:

* +2 Direct remote network reachability was not awarded. The affected code is in bridge multicast handling, but the supplied patch does not establish that untrusted multicast traffic alone can cause both the relevant list traversal and concurrent port-group deletion without additional bridge state or control-plane activity.
* +1 Attacker-influenced active-object lifetime manipulation was not awarded. The patch does not show that one attacker can repeatedly create, remove, and reclaim the affected `net_bridge_port_group` objects.
* +1 Structured stale-object exploitation leverage was not awarded. The stale use is an RCU list traversal, but no controlled object replacement, attacker-controlled post-free contents, callback dispatch, pointer reuse, or meaningful post-free field consumption is established.
* +2 Strong exploitation leverage was not awarded. No controlled reclaim, arbitrary write, directed write, type confusion, refcount takeover, information disclosure, or privilege-escalation chain is shown.
* Confidentiality and integrity points were not awarded. The patch establishes a lifetime violation, but does not establish a disclosure path or unauthorized modification primitive.
* No race penalty was applied. The bug is concurrent, but the supplied material does not prove a uniquely narrow or externally uncontrollable one-shot timing window.
* No host-administrator penalty was applied. The complete privilege boundary for creation, removal, and traversal of the affected bridge multicast state is not established.
* No niche-subsystem penalty was applied. Linux bridge multicast functionality is not inherently rare, although actual reachability depends on bridge multicast configuration.

3. Reachability analysis

The affected object belongs to Linux bridge multicast state. The immediate vulnerable sequence requires an RCU traversal by `br_multicast_list_adjacent()` to overlap with `br_multicast_del_port_group()` removing and freeing the same port group.

The supplied patch supports an RCU-reader versus deletion race, but does not provide the relevant callers or establish which actor can reliably cause both operations. An adjacent Layer 2 attacker may influence multicast membership or traffic in some bridge deployments, but the evidence does not establish that network traffic alone triggers the complete vulnerable lifetime sequence.

Host-admin-equivalent privilege is not positively established, so `HostAdminRequired=UNKNOWN`. Conversely, below-host-admin reachability is also not established, so it cannot be set to `NO`. The patch does not establish that all required operations are available from an attacker-controlled network namespace, therefore `NamespaceScopedPrivilege=UNKNOWN`.

The issue is relevant only when bridge multicast handling is enabled and the vulnerable adjacent-list traversal is exercised. No special hardware, boot parameter, firmware prerequisite, or explicit privileged setup requirement is shown in the supplied evidence.

4. Primitive and severity interpretation

The exact primitive is a real RCU lifetime violation. A `net_bridge_port_group` remains potentially reachable by an RCU list walker after deletion because the old code removes it without the RCU list helper and immediately calls `kfree()` without waiting for an RCU grace period.

This is an active structured-object UAF rather than fixed stale storage. However, the supplied context only establishes stale list traversal and potential dereference after free. It does not establish controlled reuse of the freed allocation, attacker-controlled replacement contents, an active callback or operations-table dereference, arbitrary read or write, disclosure, or a security-boundary bypass.

There is no concrete repeated release, `put`, refcount decrement, or second free through the same dangling reference. This is therefore not a repeated-lifetime-mutation case.

The correct primitive classification is `CLASS_B`. The demonstrated consequence is kernel instability or DoS through stale-object access. Privilege escalation, confidentiality impact, and integrity impact remain theoretical possibilities of a generic kernel UAF and are not established by this patch.

`ImportantCandidate=NO` because the known stale use is limited to RCU list traversal and no meaningful exploit leverage beyond a crash is demonstrated. `AutoDowngradeAllowed=YES` because this is currently a constrained Class B lifetime bug without demonstrated controlled reclaim, repeated refcount mutation, post-free attacker control, or boundary bypass. Manual review remains recommended to inspect the actual callers of `br_multicast_list_adjacent()` and bridge multicast state-management paths.

Likely operational severity is Moderate. It should be prioritized higher if downstream analysis proves that an unprivileged adjacent attacker can reliably drive group deletion and list traversal, or if stale traversal consumes attacker-influenced replacement state.

5. One-sentence report phrase

A Linux bridge multicast RCU lifetime bug can free a multicast port-group object while `br_multicast_list_adjacent()` still traverses it, potentially causing a kernel crash or denial of service.

6. Manual review recommendation

MANUAL CHECK RECOMMENDED

The patch establishes a genuine RCU use-after-free, but the supplied context does not establish complete attacker reachability or exploitation leverage beyond a crash.

7. Call-site confidence

Call-site confidence: medium

======================================================================
UPSTREAM PATCH SUMMARY
======================================================================

Patch: net: bridge: mcast: properly convert mglist to rcu [ Upstream
Commit: 98247c8264d2076f81fa114bdfa2c2271953ac7c
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=98247c8264d2076f81fa114bdfa2c2271953ac7c

Changed files:
  net/bridge/br_multicast.c

Diff excerpt:

Not included in this email. See the upstream URL for the full patch.

Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=98247c8264d2076f81fa114bdfa2c2271953ac7c

======================================================================
DETAILED REPORT METHODOLOGY
======================================================================

The original Linux kernel CVE announcement for CVE-2026-98026 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98026

The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.

The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.

The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.

Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:

  Conservative CVSS vector: AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  The Best / paranoid CVSS vector: AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  The Best / paranoid CVSS score: 7.5

The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.

CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.

A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.

  Conservative ActionableScore: unknown
  Paranoid ActionableScore: 3

The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.

For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:

  ActionableScore below 5   -> MODERATE REGULAR
  ActionableScore 5 or more -> MODERATE 7.0

The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.

There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).

KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.

AL-KERNEL base severity for this report: MODERATE
KPANIC detected for this report: NO
Published priority for this report (same as in Subject): MODERATE REGULAR

These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).

Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is alexanjelausa@gmail.com (and both
send reply to CVE record itself too and see "reply" button below for howto reply).