CVE-2026-98881 - Vulnerability Details

- net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()

Description

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()

This rcu_barrier() came from a time call_rcu() calls were used in
net/bridge/br_multicast.c.

Now kfree_rcu() is there, we can remove this problematic rcu_barrier()
which causes extreme RTNL pressure in many syzbot reports.

INFO: task syz-executor:77945 is blocked on a mutex likely owned by task kworker/u1024:5:36537.
task:kworker/u1024:5 state:D stack:24616 pid:36537 tgid:36537 ppid:2 task_flags:0x4208060 flags:0x00080000 last_sleep:612797637337
Workqueue: netns cleanup_net
Call Trace:
<TASK>
[<ffffffff81914eaa>] context_switch+0xf2a/0x1730 kernel/sched/core.c:6483
[<ffffffff81201143>] __schedule+0x1133/0x43a0 kernel/sched/core.c:8411
[<ffffffff8120446b>] __schedule_loop kernel/sched/core.c:8514 [inline]
[<ffffffff8120446b>] schedule+0xab/0x260 kernel/sched/core.c:8529
[<ffffffff8121a093>] schedule_timeout+0xc3/0x2b0 kernel/time/sleep_timeout.c:75
[<ffffffff81205347>] do_wait_for_common kernel/sched/completion.c:100 [inline]
[<ffffffff81205347>] __wait_for_common kernel/sched/completion.c:121 [inline]
[<ffffffff81205347>] wait_for_common kernel/sched/completion.c:132 [inline]
[<ffffffff81205347>] wait_for_completion+0x2c7/0x5d0 kernel/sched/completion.c:153
[<ffffffff81b8f27f>] rcu_barrier+0x49f/0x620 kernel/rcu/tree.c:3888
[<ffffffff860091b3>] br_multicast_dev_del+0x303/0x350 net/bridge/br_multicast.c:4459
[<ffffffff85fb5dbc>] br_dev_uninit+0x1c/0x40 net/bridge/br_device.c:157
[<ffffffff8568058c>] unregister_netdevice_many_notify+0x1c1c/0x2300 net/core/dev.c:12599
[<ffffffff8562be43>] ops_exit_rtnl_list net/core/net_namespace.c:187 [inline]
[<ffffffff8562be43>] ops_undo_list+0x3d3/0x940 net/core/net_namespace.c:248

Published: 2026-10-23

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 35f9f11740515a10b084adfb1ce691351f2452ab
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 0443f6aac6bf6a91e406273fdda11497cef6ad07
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ac0e823a228f94ad9d7a3d876cc07e59a7afb806
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< f0018acf0b66f93a292667c9a9c2a26c570cf270
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 372ee8fbe0f796031c60f676ec90f0788c26523d
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 39679927fa7aaf4601119f7234342d1b5d4f6f84
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 25ae123db10ba9ab890b56bcdb0a4363aee8529a
`0`	affected	< 5.10.271
`0`	affected	< 5.15.222
`0`	affected	< 6.1.189
`0`	affected	< 6.6.158
`0`	affected	< 6.12.111
`0`	affected	< 6.18.53

Linux

affected

Version	Status	Constraints
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,35f9f11740515a10b084adfb1ce691351f2452ab)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0443f6aac6bf6a91e406273fdda11497cef6ad07)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ac0e823a228f94ad9d7a3d876cc07e59a7afb806)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f0018acf0b66f93a292667c9a9c2a26c570cf270)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,372ee8fbe0f796031c60f676ec90f0788c26523d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,39679927fa7aaf4601119f7234342d1b5d4f6f84)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,25ae123db10ba9ab890b56bcdb0a4363aee8529a)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,35f9f11740515a10b084adfb1ce691351f2452ab)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0443f6aac6bf6a91e406273fdda11497cef6ad07)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ac0e823a228f94ad9d7a3d876cc07e59a7afb806)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f0018acf0b66f93a292667c9a9c2a26c570cf270)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,372ee8fbe0f796031c60f676ec90f0788c26523d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,39679927fa7aaf4601119f7234342d1b5d4f6f84)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,25ae123db10ba9ab890b56bcdb0a4363aee8529a)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0443f6aac6bf6a91e406273fdda11497cef6ad07
https://git.kernel.org/stable/c/25ae123db10ba9ab890b56bcdb0a4363aee8529a
https://git.kernel.org/stable/c/35f9f11740515a10b084adfb1ce691351f2452ab
https://git.kernel.org/stable/c/372ee8fbe0f796031c60f676ec90f0788c26523d
https://git.kernel.org/stable/c/39679927fa7aaf4601119f7234342d1b5d4f6f84
https://git.kernel.org/stable/c/ac0e823a228f94ad9d7a3d876cc07e59a7afb806
https://git.kernel.org/stable/c/f0018acf0b66f93a292667c9a9c2a26c570cf270

History

Fri, 23 Oct 2026 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 12:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() This rcu_barrier() came from a time call_rcu() calls were used in net/bridge/br_multicast.c. Now kfree_rcu() is there, we can remove this problematic rcu_barrier() which causes extreme RTNL pressure in many syzbot reports. INFO: task syz-executor:77945 is blocked on a mutex likely owned by task kworker/u1024:5:36537. task:kworker/u1024:5 state:D stack:24616 pid:36537 tgid:36537 ppid:2 task_flags:0x4208060 flags:0x00080000 last_sleep:612797637337 Workqueue: netns cleanup_net Call Trace: <TASK> [<ffffffff81914eaa>] context_switch+0xf2a/0x1730 kernel/sched/core.c:6483 [<ffffffff81201143>] __schedule+0x1133/0x43a0 kernel/sched/core.c:8411 [<ffffffff8120446b>] __schedule_loop kernel/sched/core.c:8514 [inline] [<ffffffff8120446b>] schedule+0xab/0x260 kernel/sched/core.c:8529 [<ffffffff8121a093>] schedule_timeout+0xc3/0x2b0 kernel/time/sleep_timeout.c:75 [<ffffffff81205347>] do_wait_for_common kernel/sched/completion.c:100 [inline] [<ffffffff81205347>] __wait_for_common kernel/sched/completion.c:121 [inline] [<ffffffff81205347>] wait_for_common kernel/sched/completion.c:132 [inline] [<ffffffff81205347>] wait_for_completion+0x2c7/0x5d0 kernel/sched/completion.c:153 [<ffffffff81b8f27f>] rcu_barrier+0x49f/0x620 kernel/rcu/tree.c:3888 [<ffffffff860091b3>] br_multicast_dev_del+0x303/0x350 net/bridge/br_multicast.c:4459 [<ffffffff85fb5dbc>] br_dev_uninit+0x1c/0x40 net/bridge/br_device.c:157 [<ffffffff8568058c>] unregister_netdevice_many_notify+0x1c1c/0x2300 net/core/dev.c:12599 [<ffffffff8562be43>] ops_exit_rtnl_list net/core/net_namespace.c:187 [inline] [<ffffffff8562be43>] ops_undo_list+0x3d3/0x940 net/core/net_namespace.c:248
Title		net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0443f6aac6bf6a91e406273fdda11497cef6ad07 https://git.kernel.org/stable/c/25ae123db10ba9ab890b56bcdb0a4363aee8529a https://git.kernel.org/stable/c/35f9f11740515a10b084adfb1ce691351f2452ab https://git.kernel.org/stable/c/372ee8fbe0f796031c60f676ec90f0788c26523d https://git.kernel.org/stable/c/39679927fa7aaf4601119f7234342d1b5d4f6f84 https://git.kernel.org/stable/c/ac0e823a228f94ad9d7a3d876cc07e59a7afb806 https://git.kernel.org/stable/c/f0018acf0b66f93a292667c9a9c2a26c570cf270

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T11:37:32.327Z

Updated: 2026-10-23T11:37:32.327Z

Reserved: 2026-09-25T10:25:14.378Z

Link: CVE-2026-98881

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T12:18:21.670

Modified: 2026-10-23T12:18:21.670

Link: CVE-2026-98881

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-23T14:30:13Z

Weaknesses

No weakness.

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object