PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45913 Linux CVE debrief

A logic error in the Linux kernel's bridge multicast (mcast) implementation allows an unpaired decrement of the mdb_n_entries counter, triggering a kernel warning and potential instability. The vulnerability exists because mdb_n_entries was increased conditionally based on runtime state, but decreased unconditionally during cleanup operations. A specific trigger sequence involves: creating a bridge with VLAN filtering and multicast snooping, adding a multicast database (MDB) entry, bringing the bridge down, enabling mcast_vlan_snooping (which skips the counter increment due to !netif_running check), then flushing MDB entries (which decrements the counter). This creates a negative counter scenario detected by WARN_ON(n == 0) in br_multicast_port_ngroups_dec_one(). The fix ensures mdb_n_entries is always updated for VLAN contexts by initializing on creation and maintaining accurate counts regardless of multicast option states, with limit enforcement only applied when appropriate.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Linux system administrators running bridge networking with VLAN filtering and multicast snooping; kernel maintainers tracking stable branch updates; security teams monitoring for kernel warning anomalies

Technical summary

The Linux kernel's bridge multicast subsystem maintains per-port-VLAN context counters (mdb_n_entries) to track multicast group memberships. The vulnerability stems from asymmetric accounting: increments were gated by runtime conditions (netif_running, mcast snooping enablement) while decrements occurred unconditionally during cleanup paths. Specifically, __br_multicast_enable_port_ctx() skips counter updates when !netif_running, but br_mdb_flush() and br_multicast_del_pg() always decrement. This architectural inconsistency, introduced and exacerbated by incremental feature additions over years, permits the counter to underflow. The fix (commit 45525fdfd4cb) restructures the accounting to initialize counters at VLAN context creation and maintain them consistently, applying limit enforcement only when the context is port-level or has explicit VLAN snooping enabled.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from stable branches when available
  • Monitor kernel logs for 'n == 0' warnings in br_multicast.c as potential exploitation indicators
  • Review bridge multicast configurations for systems using VLAN filtering with mcast_snooping and mcast_vlan_snooping
  • Consider disabling mcast_vlan_snooping on affected systems if multicast VLAN snooping is not required
  • Audit systems for unexpected bridge state transitions that could trigger counter desynchronization

Evidence notes

Vulnerability confirmed via syzbot crash report with full stack trace showing warning triggered at net/bridge/br_multicast.c:718. Root cause analysis and fix commit messages describe the conditional increment logic flaw. Multiple stable kernel branches received backports.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45913 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45913

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45913 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45913

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/45525fdfd4cb612d7b414dd5cfa1f43892a7cd71

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/724a405ce0309676f1e993c173382b4c4a022beb

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8b769e311a86bb9d15c5658ad283b86fc8f080a2

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d0fdad1bdd21a358cc2c85da3681ae27b86ce6ce

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fae260fc84e1eae8f590c7907e53e8768df2d986

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.