-

CVE-2026-98487

net: bridge: mdb: restart port group walk after deletion

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mdb: restart port group walk after deletion

br_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking
mp->ports. br_multicast_del_pg() can re-enter the same MDB entry through
br_multicast_sg_del_exclude_ports() and unlink other port groups. If the
cursor points into one of those groups, the next iteration dereferences a
stale cursor and can leave mp->ports pointing at freed memory.

A following RTM_GETMDB exposes the dangling pointer:

  BUG: KASAN: slab-use-after-free in br_mdb_dump
  Read of size 8
    br_mdb_dump
    rtnl_mdb_dump
    rtnl_dumpit
    netlink_dump

Reset the cursor to mp->ports after every deletion. The deletion removes at
least the selected group, so the restarted walk always makes progress.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version a6acb535afb2a3b688a7858f05b61f0433e480d5
Version < 46ec55855c972504258c371677ac039ba20e5d12
Status affected
Version a6acb535afb2a3b688a7858f05b61f0433e480d5
Version < ab3c4a4c85f2e1e8d04b5c1770dea8412d21c7fe
Status affected
Version a6acb535afb2a3b688a7858f05b61f0433e480d5
Version < fe2a42789c12eb7c5d3a42191e2cc735a6c35ead
Status affected
Version a6acb535afb2a3b688a7858f05b61f0433e480d5
Version < ab1404ac81154a89fb61ac50ae9a04cd8d4834dc
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.8
Status affected
Version 0
Version < 6.8
Status unaffected
Version <= 6.12.*
Version 6.12.112
Status unaffected
Version <= 6.18.*
Version 6.18.55
Status unaffected
Version <= 7.2.*
Version 7.2.9
Status unaffected
Version <= *
Version 7.3
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.092
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/46ec55855c972504258c371677ac039ba20e5d12
https://git.kernel.org/stable/c/ab3c4a4c85f2e1e8d04b5c1770dea8412d21c7fe
https://git.kernel.org/stable/c/fe2a42789c12eb7c5d3a42191e2cc735a6c35ead
https://git.kernel.org/stable/c/ab1404ac81154a89fb61ac50ae9a04cd8d4834dc