VulnerabilityPublished 27 May 2026Updated 6 Nov 2026

CVE-2026-45913: Linux kernel · net: bridge: mcast: always update mdb_n_entries for vlan contexts

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in fae260fc84e1eae8f590c7907e53e8768df2d986 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:05 UTC

Severity

Low

Rated Low by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in fae260fc84e1eae8f590c7907e53e8768df2d986, d0fdad1bdd21a358cc2c85da3681ae27b86ce6ce, 45525fdfd4cb612d7b414dd5cfa1f43892a7cd71 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 27 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ b57e8d870d522d905720052e6fd9c3bc9bc5f6fb, < fae260fc84e1eae8f590c7907e53e8768df2d986	Fixed in fae260fc84e1eae8f590c7907e53e8768df2d986
LinuxLinux	Affected ≥ b57e8d870d522d905720052e6fd9c3bc9bc5f6fb, < d0fdad1bdd21a358cc2c85da3681ae27b86ce6ce	Fixed in d0fdad1bdd21a358cc2c85da3681ae27b86ce6ce
LinuxLinux	Affected ≥ b57e8d870d522d905720052e6fd9c3bc9bc5f6fb, < 45525fdfd4cb612d7b414dd5cfa1f43892a7cd71	Fixed in 45525fdfd4cb612d7b414dd5cfa1f43892a7cd71
LinuxLinux	Affected ≥ b57e8d870d522d905720052e6fd9c3bc9bc5f6fb, < 724a405ce0309676f1e993c173382b4c4a022beb	Fixed in 724a405ce0309676f1e993c173382b4c4a022beb
LinuxLinux	Affected ≥ b57e8d870d522d905720052e6fd9c3bc9bc5f6fb, < 8b769e311a86bb9d15c5658ad283b86fc8f080a2	Fixed in 8b769e311a86bb9d15c5658ad283b86fc8f080a2
LinuxLinux	Affected =6.3	Fixed in–

AI-suggested

A fix for this vulnerability has been committed to the Linux kernel. Users should update to the fixed kernel versions identified by the commit hashes provided in the established facts. No additional mitigation is required beyond applying the official patch.

Description

CVE-2026-45913 is a vulnerability in the Linux kernel's network bridge multicast handling. It involves incorrect updating of multicast database entry counts (mdb_n_entries) for VLAN contexts, which can trigger warnings and potentially lead to inconsistent state. The issue arises because the count increase was conditional and did not always match decreases, especially when multicast snooping was enabled or disabled under certain conditions. The fix ensures the count is always updated correctly regardless of multicast options.

Impact

The impact is primarily a kernel warning triggered by inconsistent multicast database entry counts, which may indicate unstable multicast group management on network bridges. There is no indication of remote code execution, privilege escalation, or denial of service beyond the warning and potential instability. No known exploits in the wild have been reported.

Summary

This vulnerability in the Linux kernel's bridge multicast code causes the multicast database entry count (mdb_n_entries) for VLAN contexts to be updated conditionally, leading to mismatches between increments and decrements. This inconsistency can trigger kernel warnings and may cause unstable behavior in multicast group management on bridge devices. The root cause is that the count increase was not always performed, especially when multicast snooping was toggled while the interface was down. The fix removes the conditional increment and ensures the count is always updated when VLAN contexts exist, initializing counts on port-vlan context creation and enforcing limits only when appropriate.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 16:05 UTC

Technical details

References

Community reviews

Related threats