CVE-2024-26837: 
Linux Kernel vulnerability analysis and mitigation

A race condition vulnerability was discovered in the Linux kernel's network bridge management system, specifically in the handling of MDB (Multicast Database) events during switchdev offload. The vulnerability (CVE-2024-26837) was identified and resolved in the Linux kernel, affecting the generation of MDB events replay list which could race against the creation of new group memberships (Kernel Git).

The vulnerability occurs when generating the list of MDB events to replay, which could race against new group membership creation from either IGMP/MLD snooping logic or user configuration. While new memberships are immediately visible to walkers of br->mdb_list, their notification to switchdev event subscribers is deferred. This results in the driver receiving duplicate events for what the bridge internally considers a single event, as the replay list could contain a replay of not-yet-delivered events (Kernel Git).

The vulnerability can lead to orphaned groups remaining in the hardware database when a bridge is destroyed. This occurs because drivers which reference count memberships (particularly DSA) receive duplicate membership notifications but only a single deletion event. As a result, old group memberships from a previously attached bridge port could be reanimated in hardware when the port joins a new bridge, without the new bridge's knowledge (Kernel Git).

The issue manifests specifically in network configurations using bridge multicast snooping with hardware offload. A practical example demonstrates the vulnerability using an mv88e6xxx system, where IPv6 groups remain in the hardware database after bridge destruction and affect subsequent bridge configurations (Kernel Git).

The vulnerability has been patched with a two-step solution: 1) Implementation of a write-side lock of the MDB while generating the replay list to prevent new memberships from appearing during list generation, and 2) Addition of checks to ensure no deferred version of a replay event is already enqueued to the switchdev deferred queue before adding it to the replay list when replaying additions (Kernel Git).