Linux kernel: Use-after-free in bridge multicast MDB port group deletion
Summary
A flaw in the Linux kernel bridge multicast snooping database (MDB) can leave a dangling pointer after port groups are deleted. A local user with low privileges who can change bridge configuration may be able to trigger a use-after-free in the MDB dump path, which can crash the system or potentially be used to affect confidentiality, integrity and availability. The issue is not directly reachable from the internet and needs local access with some privilege.
Affected
- Linux kernel from 6.8 up to (not including) 6.12.112
- Linux kernel from 6.13 up to (not including) 6.18.55
- Linux kernel from 6.19 up to (not including) 7.2.9
- Ubuntu 24.04 LTS (noble) and 26.04 LTS (resolute): vulnerable per Ubuntu, fixes in progress
- Ubuntu 22.04, 20.04 and 26.10: listed as not affected
Fixed in
- Upstream stable kernels 6.12.112, 6.18.55 and 7.2.9 and later
- Ubuntu 24.04: fix in progress in 6.8.0-148.148
- Ubuntu 26.04: fix in progress in 7.0.0-42.42
- Exact fixed version for 7.0.x stable: Unknown.
Workaround
- No vendor-published workaround known.
- Limit who can change bridge or network configuration, for example network admin rights in containers or VMs.
- Effect of disabling multicast snooping on this path: Unknown.
Exploitation
- CISA KEV: not listed.
- Public proof of concept: none found.
- Exploited in the wild: nothing known.
- The KASAN trace in the description is a crash report, not an exploit.
Our recommendation
- Install the kernel update from your distribution as soon as it is available.
- Check whether your hosts run bridges, hypervisors or container hosts with untrusted local users, and prioritise them.
- Ask your distribution for the fixed package version, especially for 7.0.x kernels.
- Verify the running kernel version after the reboot.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable commit 46ec55855c972504258c371677ac039ba20e5d12 git.kernel.org
- Linux kernel stable commit ab1404ac81154a89fb61ac50ae9a04cd8d4834dc git.kernel.org
- Linux kernel stable commit ab3c4a4c85f2e1e8d04b5c1770dea8412d21c7fe git.kernel.org
- Linux kernel stable commit fe2a42789c12eb7c5d3a42191e2cc735a6c35ead git.kernel.org
- OSV record CVE-2026-98487 osv.dev
- Ubuntu security notice CVE-2026-98487 ubuntu.com
- Alpaquita OSV record BELL-CVE-2026-98487 osv.dev
- Strix CVE-2026-98487 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:45.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion br_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking mp->ports. br_multicast_del_pg() can re-enter the same MDB entry through br_multicast_sg_del_exclude_ports() and unlink other port groups. If the cursor points into one of those groups, the next iteration dereferences a stale cursor and can leave mp->ports pointing at freed memory. A following RTM_GETMDB exposes the dangling pointer: BUG: KASAN: slab-use-after-free in br_mdb_dump Read of size 8 br_mdb_dump rtnl_mdb_dump rtnl_dumpit netlink_dump Reset the cursor to mp->ports after every deletion. The deletion removes at least the selected group, so the restarted walk always makes progress.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.