PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45913 Linux CVE debrief

A logic error in the Linux kernel's bridge multicast (mcast) implementation allows an unpaired decrement of the mdb_n_entries counter, triggering a kernel warning and potential instability. The vulnerability exists because mdb_n_entries was increased conditionally based on runtime state, but decreased unconditionally during cleanup operations. A specific trigger sequence involves: creating a bridge with VLAN filtering and multicast snooping, adding a multicast database (MDB) entry, bringing the bridge down, enabling mcast_vlan_snooping (which skips the counter increment due to !netif_running check), then flushing MDB entries (which decrements the counter). This creates a negative counter scenario detected by WARN_ON(n == 0) in br_multicast_port_ngroups_dec_one(). The fix ensures mdb_n_entries is always updated for VLAN contexts by initializing on creation and maintaining accurate counts regardless of multicast option states, with limit enforcement only applied when appropriate.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators running bridge networking with VLAN filtering and multicast snooping; kernel maintainers tracking stable branch updates; security teams monitoring for kernel warning anomalies

Technical summary

The Linux kernel's bridge multicast subsystem maintains per-port-VLAN context counters (mdb_n_entries) to track multicast group memberships. The vulnerability stems from asymmetric accounting: increments were gated by runtime conditions (netif_running, mcast snooping enablement) while decrements occurred unconditionally during cleanup paths. Specifically, __br_multicast_enable_port_ctx() skips counter updates when !netif_running, but br_mdb_flush() and br_multicast_del_pg() always decrement. This architectural inconsistency, introduced and exacerbated by incremental feature additions over years, permits the counter to underflow. The fix (commit 45525fdfd4cb) restructures the accounting to initialize counters at VLAN context creation and maintain them consistently, applying limit enforcement only when the context is port-level or has explicit VLAN snooping enabled.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from stable branches when available
  • Monitor kernel logs for 'n == 0' warnings in br_multicast.c as potential exploitation indicators
  • Review bridge multicast configurations for systems using VLAN filtering with mcast_snooping and mcast_vlan_snooping
  • Consider disabling mcast_vlan_snooping on affected systems if multicast VLAN snooping is not required
  • Audit systems for unexpected bridge state transitions that could trigger counter desynchronization

Evidence notes

Vulnerability confirmed via syzbot crash report with full stack trace showing warning triggered at net/bridge/br_multicast.c:718. Root cause analysis and fix commit messages describe the conditional increment logic flaw. Multiple stable kernel branches received backports.

Official resources

2026-05-27