net: bridge: mcast: properly convert mglist to rcu (CVE-2026-98026) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-98026

net: bridge: mcast: properly convert mglist to rcu

Answer in brief

CVE-2026-98026 records a Unknown severity vulnerability in net: bridge: mcast: properly convert mglist to rcu. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 25, 2026Updated Sep 25, 2026Source checked Sep 25, 2026First seen by HOL Sep 25, 2026Material review Sep 25, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=07f8ac4a1e26e8283542cdaf658a6e2a12fd6980 <98247c8264d2076f81fa114bdfa2c2271953ac7c \|\| >=07f8ac4a1e26e8283542cdaf658a6e2a12fd6980 <38ab2a435001a3c4dbeb70a52f5921e1ccd66f55 \|\| >=07f8ac4a1e26e8283542cdaf658a6e2a12fd6980 <f7bf57e94a5d6214b87be08486cb33836fbfa573 \|\| >=07f8ac4a1e26e8283542cdaf658a6e2a12fd6980 <4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0	98247c8264d2076f81fa114bdfa2c2271953ac7c, 38ab2a435001a3c4dbeb70a52f5921e1ccd66f55, f7bf57e94a5d6214b87be08486cb33836fbfa573, 4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0
Linux/Linuxgeneric	3.16	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 98247c8264d2076f81fa114bdfa2c2271953ac7c if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 25, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: properly convert mglist to rcu Sashiko reported a bug [1] that br_multicast_del_port_group unlists the port group not using proper rcu helper that preserves the next pointer and after that immediately frees the port group without waiting for rcu grace period. The only rcu walker of mglist is br_multicast_list_adjacent() and it turns out that function has always been buggy because mglist was never properly converted to RCU. Fix it by converting it to rcu and moving its initialization after eth_addr's. Initializing p->next can use RCU_INIT_POINTER because we have a barrier from the hlist_add_head_rcu call later, besides we're initializing an unpublished structure anyway. [1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260826014200.362304-1-littleddfu%40gmail.com

Quoted source text, attributed separately from HOL analysis.