In the Linux kernel, the following vulnerability has been resolved: net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() This… (CVE-2026-98881)

The Linux kernel vulnerability CVE-2026-98881 involves a stale rcu_barrier() call in the net/bridge/br_multicast.c file, specifically in the br_multicast_dev_del() function. This rcu_barrier() was a remnant from when call_rcu() was used, but since kfree_rcu() replaced it, the barrier became problematic. It caused extreme RTNL pressure and task blocking, as evidenced by syzbot reports showing tasks blocked on mutexes likely owned by kernel worker threads. The fix removes this obsolete rcu_barrier() to prevent these issues.

The vulnerability causes excessive RTNL pressure in the kernel, leading to tasks being blocked on mutexes and potential performance degradation or system responsiveness issues. There is no indication of direct security compromise such as privilege escalation or code execution from the provided data.

A fix has been implemented in the Linux kernel by removing the stale rcu_barrier() call in br_multicast_dev_del(). Users should update to the kernel version that includes this fix. Since this is a kernel-level fix, applying the official kernel update from the vendor or distribution is the recommended remediation.