CVE-2026-64032 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users of Linux-based systems should be aware of this vulnerability and take steps to ensure their systems are patched. This includes reviewing system configurations, updating vulnerable systems, and monitoring for potential issues.

Technical summary

The Linux kernel vulnerability CVE-2026-64032 is related to the bridge module's handling of multicast snooping. When per-VLAN multicast snooping is enabled, the bridge iterates over all bridge ports, disables the per-port multicast context on each port, and enables the per-{port, VLAN} multicast contexts instead. However, when global multicast snooping is enabled, the bridge enables the per-port multicast context on each port. This can result in both types of contexts being enabled on a single bridge port, leading to a use-after-free when the port is removed. The fix prevents the bridge from enabling or disabling the per-port multicast contexts when toggling global multicast snooping if per-VLAN multicast snooping is enabled.

Defensive priority

High

Recommended defensive actions

• Apply the patch to the Linux kernel
• Ensure per-VLAN multicast snooping is properly configured
• Monitor system logs for potential issues
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved by preventing the bridge from enabling or disabling the per-port multicast contexts when toggling global multicast snooping if per-VLAN multicast snooping is enabled. The fix addresses the use-after-free issue that could occur when removing a bridge port. This fix was applied to the Linux kernel to prevent exploitation of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.