CVE-2026-80842

UNRATEDCVSS · not yet scored

Also known asEUVD-2026-71292 (ENISA EUVD) · GHSA-4rr3-fvjp-hj2g (GitHub Security Advisories)Source: ENISA EUVD

—
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
  • No CVSS published and no exploitation signals yet
CISA-KEV: Not listedEPSS PROB: 0.2%CVSS v2: —Exploit: None knownExposed services: Not assessed

A fix is available — apply it.

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mcast: fix use-after-free of a master VLAN's multicast context

br_multicast_toggle_one_vlan() clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before stopping a VLAN's multicast context. That is the teardown handshake: lockless readers gate on the flag through br_multicast_ctx_should_use() -> br_multicast_ctx_vlan_disabled(), so once it is cleared under the lock no reader can arm the context again.

For a master VLAN the handshake never runs. __vlan_del() clears BRIDGE_VLAN_INFO_BRENTRY before calling br_vlan_put_master(), so br_multicast_toggle_one_vlan(masterv, false) returns early on !br_vlan_is_brentry(vlan): the flag stays set and br->multicast_lock is never taken. br_vlan_put_master() then drains the context in br_multicast_ctx_deinit() and frees the VLAN through call_rcu(), while a reader still inside rcu_read_lock() sees the context as enabled and re-arms it. The port and port-VLAN branch of the function has no br_vlan_is_brentry() test and flips the flag under br->multicast_lock, so it is not affected.

The reader is the bridge transmit path. For a master VLAN br_multicast_rcv() selects brmctx = &vlan->br_mcast_ctx with pmctx = NULL, so IGMP sent to the bridge device re-arms the context's timers after br_multicast_ctx_deinit() has already stopped them.

BUG: KASAN: slab-use-after-free in detach_if_pending+0x412/0x4a0 Write of size 8 at addr ffff88810ac39918 by task brmc/601 __mod_timer+0x51a/0xc50 br_multicast_host_join+0x25b/0x390 __br_multicast_add_group+0x468/0x530 br_ip4_multicast_add_group+0x1a0/0x260 br_multicast_rcv+0x2cda/0x61e0 br_dev_xmit+0x6c4/0x1540 Allocated by task 610: br_vlan_add+0x111/0xb40 br_vlan_info+0x370/0x3e0 Freed by task 0: kfree+0x1a7/0x4f0 rcu_core+0x7dc/0x10a0

Only test br_vlan_is_brentry() when enabling, like the br_multicast_ctx_vlan_global_disabled() test next to it. Disabling then always clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before br_multicast_ctx_deinit() drains the context.

CVSS v3
—
EchelonGraph score
Not yet assessedNo source has published severity data for this CVE yet — no CVSS score from NVD or a CNA, no GitHub advisory, and it is not in CISA KEV. This is not a rating of zero; we cannot assess it yet.
EG Score
—
EG Risk
—
EPSS PROB
0.2%
EPSS %ILE
7th
KEV
Not listed

What the EG score is made of (scorer v4.0: the three questions the 0–10 score mixes, published apart · methodology)

EG Severity
Not assessed: no CVSS publishedA missing CVSS is not a severity of zero.
EG Likelihood
0.2% within 30 daysSource: FIRST EPSS (model v2026.06.15, score date 2026-10-24). FIRST's exploitation probability, not an EchelonGraph model.
Confirmed exploitation
None on record (CISA KEV, EG-KEV Tier 1)Reported apart from the likelihood: an observed fact, not a probability.
EG Priority
No SSVC decision: EchelonGraph has not assessed this CVECISA BOD 26-04: 14 days if the affected system is publicly exposed; Fix on system upgrade if it is not.Each input and its source: the BOD 26-04 block below.

BOD 26-04 (CISA's remediation timeline, Table 1)14 days if the affected system is publicly exposed; Fix on system upgrade if it is not.

In CISA KEV no (CISA's KEV catalog) · Automatable no (CISA's BOD 26-04 default) · Technical impact total (CISA's BOD 26-04 default). Where an input reads “CISA's BOD 26-04 default”, no one has published it for this CVE, and CISA's implementation guidance says: “If “Automatable” and “Technical Impact” information items about a CVE ID are not available and the CVE ID is not in the KEV Catalog, CISA will treat its values as “no” and “total,” respectively, until CISA or a third party provides metadata about the CVE ID. CISA will always provide the Vulnrichment data for a CVE ID listed in the KEV Catalog.” Whether your system is publicly exposed is yours to answer. BOD 26-04 binds US Federal Civilian Executive Branch agencies; for anyone else it is CISA's published timeline, a reference rather than an obligation. The directive · how EchelonGraph applies it

Published

September 4, 2026

Last Modified

October 19, 2026

References (8)

Vendor Advisories for CVE-2026-80842(2)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Affected Packages

(4 across 3 ecosystems)
Debian:12(2)
PackageVulnerable rangeFix by version rangeDependents
linux6.1.106-1 ... 6.1.99-1 (56 versions)
  • every version up to 6.1.187-1: fixed in 6.1.187-1
—
linux-6.126.12.100-1~deb12u1, 6.12.101-1~deb12u1, 6.12.107-1~deb12u1
  • every version up to 6.12.111-1~deb12u1: fixed in 6.12.111-1~deb12u1
—
Debian:13(1)
PackageVulnerable rangeFix by version rangeDependents
linux6.12.100-1 ... 6.12.96-1 (35 versions)
  • every version up to 6.12.111-1: fixed in 6.12.111-1
—
Debian:14(1)
PackageVulnerable rangeFix by version rangeDependents
linux6.12.100-1 ... 7.1~rc7-1~exp1 (172 versions)
  • every version up to 7.1.13-1: fixed in 7.1.13-1
—

Data Freshness Timeline

(refreshed 7× in last 7d / 49× in last 30d)

Each row is a time one of our pipelines fetched, updated or re-scored this CVE. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. An arrow marks a change the record states ("CVSS v3 → 9.1"); EPSS and GHSA rows show the values recorded at that time, not what changed (EPSS values are rounded; hover one for the exact figures). Most recent first.

A repeat, a row identical to one the same pipeline wrote less than 10 seconds earlier, is not a separate refresh and is not counted. 2 repeat rows among the latest 82 are merged into the row they repeat.

  1. 2026-10-26 16:32 UTCEPSS rescoreEPSS 0.2% · 7th percentile
  2. 2026-10-25 16:34 UTCEPSS rescoreEPSS 0.2% · 7th percentile
  3. 2026-10-25 13:59 UTCEG score recompute
  4. 2026-10-24 16:33 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  5. 2026-10-22 16:35 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  6. 2026-10-21 16:33 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  7. 2026-10-20 16:33 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  8. 2026-10-19 16:33 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  9. 2026-10-19 09:25 UTCNVD update
  10. 2026-10-19 09:23 UTCEG score recompute
  11. 2026-10-19 09:23 UTCVendor advisory
  12. 2026-10-19 09:23 UTCGHSA enrichmentGHSA-4rr3-fvjp-hj2g
  13. 2026-10-19 08:58 UTCMITRE cvelistV5
  14. 2026-10-18 16:33 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  15. 2026-10-18 03:09 UTCEG score recompute
  16. 2026-10-17 16:35 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  17. 2026-10-16 16:44 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  18. 2026-10-15 16:33 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  19. 2026-10-14 16:33 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  20. 2026-10-13 16:35 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  21. 2026-10-12 16:35 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  22. 2026-10-12 14:57 UTCEG score recompute
  23. 2026-10-11 19:21 UTCEG score recompute
  24. 2026-10-11 16:37 UTCEG score recompute
  25. 2026-10-11 13:55 UTCEG score recompute
Show 55 more
  1. 2026-10-10 20:00 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  2. 2026-10-09 20:07 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  3. 2026-10-09 05:23 UTCVendor advisory
  4. 2026-10-09 05:23 UTCGHSA enrichmentGHSA-4rr3-fvjp-hj2g
  5. 2026-10-08 17:13 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  6. 2026-10-07 23:48 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  7. 2026-10-06 15:18 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  8. 2026-10-06 08:59 UTCVendor advisory
  9. 2026-10-06 08:58 UTCGHSA enrichmentGHSA-4rr3-fvjp-hj2g
  10. 2026-10-05 17:43 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  11. 2026-10-04 23:22 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  12. 2026-10-03 14:26 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  13. 2026-10-03 12:35 UTCVendor advisory
  14. 2026-10-03 12:35 UTCGHSA enrichmentGHSA-4rr3-fvjp-hj2g
  15. 2026-10-02 17:57 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  16. 2026-10-01 19:50 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  17. 2026-09-30 15:04 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  18. 2026-09-30 11:18 UTCEG score recompute
  19. 2026-09-30 11:18 UTCVendor advisory
  20. 2026-09-30 11:18 UTCGHSA enrichmentGHSA-4rr3-fvjp-hj2g
  21. 2026-09-28 13:52 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  22. 2026-09-27 14:15 UTCVendor advisory
  23. 2026-09-27 14:15 UTCGHSA enrichmentGHSA-4rr3-fvjp-hj2g
  24. 2026-09-27 13:48 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  25. 2026-09-26 15:59 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  26. 2026-09-26 00:28 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  27. 2026-09-24 17:12 UTCVendor advisory
  28. 2026-09-24 17:12 UTCGHSA enrichmentGHSA-4rr3-fvjp-hj2g
  29. 2026-09-24 14:04 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  30. 2026-09-22 16:01 UTCEPSS rescoreEPSS 0.2% · 7th percentile
  31. 2026-09-21 21:09 UTCEPSS rescoreEPSS 0.2% · 7th percentile
  32. 2026-09-21 20:49 UTCVendor advisory
  33. 2026-09-21 20:49 UTCGHSA enrichmentGHSA-4rr3-fvjp-hj2g
  34. 2026-09-20 20:16 UTCEPSS rescoreEPSS 0.2% · 7th percentile
  35. 2026-09-19 00:25 UTCVendor advisory
  36. 2026-09-19 00:25 UTCGHSA enrichmentGHSA-4rr3-fvjp-hj2g
  37. 2026-09-18 19:28 UTCEPSS rescoreEPSS 0.2% · 7th percentile
  38. 2026-09-16 14:08 UTCEPSS rescoreEPSS 0.2% · 7th percentile
  39. 2026-09-16 05:15 UTCEPSS rescoreEPSS 0.2% · 7th percentile
  40. 2026-09-16 04:02 UTCVendor advisory
  41. 2026-09-16 04:01 UTCGHSA enrichmentGHSA-4rr3-fvjp-hj2g
  42. 2026-09-15 03:12 UTCEPSS rescoreEPSS 0.2% · 7th percentile
  43. 2026-09-13 07:36 UTCVendor advisory
  44. 2026-09-13 07:36 UTCGHSA enrichmentGHSA-4rr3-fvjp-hj2g
  45. 2026-09-11 14:53 UTCEPSS rescoreEPSS 0.2% · 7th percentile
  46. 2026-09-10 11:12 UTCGHSA enrichmentGHSA-4rr3-fvjp-hj2g
  47. 2026-09-08 22:01 UTCEPSS rescoreEPSS 0.2% · 7th percentile
  48. 2026-09-07 14:40 UTCEG score recompute
  49. 2026-09-07 14:40 UTCVendor advisory
  50. 2026-09-07 14:40 UTCGHSA enrichmentGHSA-4rr3-fvjp-hj2g
  51. 2026-09-06 13:48 UTCEPSS rescoreEPSS 0.2% · 7th percentile
  52. 2026-09-05 15:31 UTCEPSS rescoreEPSS 0.2% · 7th percentile
  53. 2026-09-04 16:22 UTCNVD update
  54. 2026-09-04 16:05 UTCEG score recompute
  55. 2026-09-04 16:04 UTCMITRE cvelistV5first tracked

Frequently asked(4)

What is CVE-2026-80842?
CVE-2026-80842 is a vulnerability whose severity is not yet rated; its CVE record was published on September 4, 2026. In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context brmulticasttoggleonevlan() clears BRVLFLAGMCAST_ENABLED under br->multicast_lock before stopping a VLAN's multicast context. That is the teardown…
When was the CVE record for CVE-2026-80842 published?
The CVE record for CVE-2026-80842 was published on September 4, 2026. That is the record's publication date; the vulnerability itself may have been made public earlier. EchelonGraph's copy of the record carries a last-modified date of October 19, 2026; the record at its source may have been updated since.
Is CVE-2026-80842 actively exploited?
CVE-2026-80842 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0.2% probability of exploitation in the next 30 days (7th percentile of EPSS-scored CVEs).
How do I remediate CVE-2026-80842?
A fix for CVE-2026-80842 is available: update to the fixed version the vendor names in its advisory. The vendor advisories EchelonGraph has for CVE-2026-80842 are linked in the Vendor Advisories panel on this page.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-80842

Explore →

Is Your Infrastructure Affected by CVE-2026-80842?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Book a Demo →Browse All CVEs