Not yet scoredPublished Oct 23, 2026

CVE-2026-98881net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()

Updated under an hour ago (Oct 28, 2026, 4:40 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() This rcu_barrier() came from a time call_rcu() calls were used in net/bridge/br_multicast.c. Now kfree_rcu() is there, we can remove this problematic rcu_barrier() which causes extreme RTNL pressure in many syzbot reports. INFO: task syz-executor:77945 is blocked on a mutex likely owned by task kworker/u1024:5:36537. task:kworker/u1024:5 state:D stack:24616 pid:36537 tgid:36537 ppid:2 task_flags:0x4208060 flags:0x00080000 last_sleep:612797637337 Workqueue: netns cleanup_net Call Trace: <TASK> [<ffffffff81914eaa>] context_switch+0xf2a/0x1730 kernel/sched/core.c:6483 [<ffffffff81201143>] __schedule+0x1133/0x43a0 kernel/sched/core.c:8411 [<ffffffff8120446b>] __schedule_loop kernel/sched/core.c:8514 [inline] [<ffffffff8120446b>] schedule+0xab/0x260 kernel/sched/core.c:8529 [<ffffffff8121a093>] schedule_timeout+0xc3/0x2b0 kernel/time/sleep_timeout.c:75 [<ffffffff81205347>] do_wait_for_common kernel/sched/completion.c:100 [inline] [<ffffffff81205347>] __wait_for_common kernel/sched/completion.c:121 [inline] [<ffffffff81205347>] wait_for_common kernel/sched/completion.c:132 [inline] [<ffffffff81205347>] wait_for_completion+0x2c7/0x5d0 kernel/sched/completion.c:153 [<ffffffff81b8f27f>] rcu_barrier+0x49f/0x620 kernel/rcu/tree.c:3888 [<ffffffff860091b3>] br_multicast_dev_del+0x303/0x350 net/bridge/br_multicast.c:4459 [<ffffffff85fb5dbc>] br_dev_uninit+0x1c/0x40 net/bridge/br_device.c:157 [<ffffffff8568058c>] unregister_netdevice_many_notify+0x1c1c/0x2300 net/core/dev.c:12599 [<ffffffff8562be43>] ops_exit_rtnl_list net/core/net_namespace.c:187 [inline] [<ffffffff8562be43>] ops_undo_list+0x3d3/0x940 net/core/net_namespace.c:248

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 26, 2026
First seen by InfoSec Signals: Oct 23, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 19e3a9c90c53479fecaa02307bf2db5ab8b3ffe3 before 35f9f11740515a10b084adfb1ce691351f2452ab; from 19e3a9c90c53479fecaa02307bf2db5ab8b3ffe3 before 0443f6aac6bf6a91e406273fdda11497cef6ad07; from 19e3a9c90c53479fecaa02307bf2db5ab8b3ffe3 before ac0e823a228f94ad9d7a3d876cc07e59a7afb806; from 19e3a9c90c53479fecaa02307bf2db5ab8b3ffe3 before f0018acf0b66f93a292667c9a9c2a26c570cf270; from 19e3a9c90c53479fecaa02307bf2db5ab8b3ffe3 before 372ee8fbe0f796031c60f676ec90f0788c26523d; from 19e3a9c90c53479fecaa02307bf2db5ab8b3ffe3 before 39679927fa7aaf4601119f7234342d1b5d4f6f84; from 19e3a9c90c53479fecaa02307bf2db5ab8b3ffe3 before 25ae123db10ba9ab890b56bcdb0a4363aee8529a	CNA record

References

References

https://git.kernel.org/stable/c/35f9f11740515a10b084adfb1ce691351f2452ab
https://git.kernel.org/stable/c/0443f6aac6bf6a91e406273fdda11497cef6ad07
https://git.kernel.org/stable/c/ac0e823a228f94ad9d7a3d876cc07e59a7afb806
https://git.kernel.org/stable/c/f0018acf0b66f93a292667c9a9c2a26c570cf270
https://git.kernel.org/stable/c/372ee8fbe0f796031c60f676ec90f0788c26523d
https://git.kernel.org/stable/c/39679927fa7aaf4601119f7234342d1b5d4f6f84
https://git.kernel.org/stable/c/25ae123db10ba9ab890b56bcdb0a4363aee8529a

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.