Cloudanix VulnDB

CVE-2026-98881

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux network bridge cleanup code can make the computer slow or unresponsive when removing network setups.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Unnecessary rcu_barrier() call in br_multicast_dev_del() during netns cleanup triggers prolonged RTNL lock contention and completion waits, manifesting as scheduler blocks and high pressure on the rtnl mutex.

Why it matters to the business

Systems may experience temporary unresponsiveness or elevated CPU usage when deleting network bridges or cleaning up network namespaces, potentially disrupting network-dependent services until the operation completes.

How an attack unfolds

An attacker with local privileges repeatedly creates and destroys network namespaces or bridge devices to force repeated calls into the problematic cleanup path, amplifying RTNL contention and inducing resource starvation or denial of service.

How to fix it

Upgrade to a Linux kernel version that removes the stale rcu_barrier() call from br_multicast_dev_del() as described in the fix; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the rcu_barrier() invocation has been removed from net/bridge/br_multicast.c in the running kernel source or binary; monitor for absence of the described completion wait stack traces during netns cleanup.

Typical attack path

  1. Obtain local unprivileged access on a Linux system using the affected kernel
  2. Create and configure bridge devices or network namespaces
  3. Trigger repeated device deletion or namespace cleanup operations
  4. Observe or induce RTNL mutex contention leading to blocked tasks and system pressure

How to detect it

Review kernel logs and stack traces for blocked tasks waiting on rcu_barrier during unregister_netdevice_many_notify or br_multicast_dev_del calls; correlate with netns cleanup activity.

What your security team should do

  • Prioritize kernel updates on systems that frequently manage bridges or network namespaces
  • Monitor syzbot or kernel mailing list reports for related regressions after patching
  • Test network namespace teardown workloads in staging before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() This rcu_barrier() came from a time call_rcu() calls were used in net/bridge/br_multicast.c. Now kfree_rcu() is there, we can remove this problematic rcu_barrier() which causes extreme RTNL pressure in many syzbot reports. INFO: task syz-executor:77945 is blocked on a mutex likely owned by task kworker/u1024:5:36537. task:kworker/u1024:5 state:D stack:24616 pid:36537 tgid:36537 ppid:2 task_flags:0x4208060 flags:0x00080000 last_sleep:612797637337 Workqueue: netns cleanup_net Call Trace: <TASK> [<ffffffff81914eaa>] context_switch+0xf2a/0x1730 kernel/sched/core.c:6483 [<ffffffff81201143>] __schedule+0x1133/0x43a0 kernel/sched/core.c:8411 [<ffffffff8120446b>] __schedule_loop kernel/sched/core.c:8514 [inline] [<ffffffff8120446b>] schedule+0xab/0x260 kernel/sched/core.c:8529 [<ffffffff8121a093>] schedule_timeout+0xc3/0x2b0 kernel/time/sleep_timeout.c:75 [<ffffffff81205347>] do_wait_for_common kernel/sched/completion.c:100 [inline] [<ffffffff81205347>] __wait_for_common kernel/sched/completion.c:121 [inline] [<ffffffff81205347>] wait_for_common kernel/sched/completion.c:132 [inline] [<ffffffff81205347>] wait_for_completion+0x2c7/0x5d0 kernel/sched/completion.c:153 [<ffffffff81b8f27f>] rcu_barrier+0x49f/0x620 kernel/rcu/tree.c:3888 [<ffffffff860091b3>] br_multicast_dev_del+0x303/0x350 net/bridge/br_multicast.c:4459 [<ffffffff85fb5dbc>] br_dev_uninit+0x1c/0x40 net/bridge/br_device.c:157 [<ffffffff8568058c>] unregister_netdevice_many_notify+0x1c1c/0x2300 net/core/dev.c:12599 [<ffffffff8562be43>] ops_exit_rtnl_list net/core/net_namespace.c:187 [inline] [<ffffffff8562be43>] ops_undo_list+0x3d3/0x940 net/core/net_namespace.c:248

Affected packages

Ecosystem Package Introduced Fixed