Linux kernel: Use-after-free in bridge multicast port group teardown
Summary
A flaw in the Linux kernel bridge multicast code (net/bridge/br_multicast.c) can lead to a use-after-free when port group entries are removed during bridge port teardown. A local user with low privileges could trigger memory corruption, and the CVSS vector rates the impact on confidentiality, integrity and availability as high. Exploitation requires local access and the ability to configure bridge multicast, which normally needs elevated network privileges.
Affected
- Linux kernel versions from 5.10 onward that include commit b08123684bd5, up to the fixed stable releases listed below (per the CNA and OSV records; the exact list is not fully verified)
- Versions 7.3 and later are listed as unaffected by the CNA record
Fixed in
- 5.10.273
- 5.15.224
- 6.1.191
- 6.6.161
- 6.12.115
- 6.18.59
- 7.2.13
- For other stable and distribution kernels, check the security tracker of your distribution
Workaround
Unknown.
- No vendor workaround known. Install a fixed kernel from your distribution and reboot.
Exploitation
- No public exploitation known at the time of research.
- Not verified against the CISA KEV catalogue.
- EPSS score: 0.18 % (percentile 7).
Our recommendation
- Install the fixed kernel version of your distribution through the normal update cycle and reboot.
- Prioritise shared Linux hosts, hypervisors and container hosts where untrusted local users can run code.
- Identify hosts that use Linux bridges with multicast snooping and check their kernel versions.
- Low priority for single-tenant servers without local untrusted users.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record reference: stable commit 025c25ad73323c7dc5af4ee97fe0a2c0b3c177c8 git.kernel.org
- CVE record reference: stable commit 5a3f7a683aee56e1f15c9d53041f3236767eaae7 git.kernel.org
- CVE record reference: stable commit be331b23c650de9518f8266b901d8abb9b36af77 git.kernel.org
- CVE record reference: stable commit e69d4927dacd6ddaff09777a89efc0d3143d3b0d git.kernel.org
- OSV entry (Alpaquita, distribution package versions) osv.dev
- Ubuntu security tracker ubuntu.com
- Debian CVE tracker mirror (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:04.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: don't truncate the port group walk on teardown __br_multicast_disable_port_ctx() and br_multicast_del_port() walk port->mglist with hlist_for_each_entry_safe(). However, br_multicast_find_del_pg() can also delete other entries from the same list through br_multicast_fwd_src_remove() or __fwd_del_star_excl(). If such an entry is the iterator's saved next node, hlist_del_init() clears its ->next and terminates the walk early. The reproducer triggers this in both teardown walks, leaving port groups in the bridge mdb with a dangling ->key.port after del_nbp() frees the port: BUG: KASAN: slab-use-after-free in __mdb_fill_info+0x1191/0x1320 __mdb_fill_info+0x1191/0x1320 br_mdb_dump+0x594/0xe40 rtnl_mdb_dump+0x1cf/0x5d0 Use hlist_del_init_rcu() to unlink the group while preserving ->next. br_multicast_del_pg() and the teardown walks run under br->multicast_lock. The GC worker must acquire the same lock before detaching the group for destruction, so the node remains alive while the walk uses the preserved pointer. Preserving ->next means a walk can now reach a group that an earlier iteration already deleted as a side effect. That group is off mp->ports, so br_multicast_find_del_pg() would fall through its port scan and hit the trailing WARN_ON(1). Skip such groups at the top of that helper: a port group is put on port->mglist when it is created and only unlinked when it is deleted, so hlist_unhashed() identifies exactly this case.
NVD references (8)
- https://git.kernel.org/stable/c/025c25ad73323c7dc5af4ee97fe0a2c0b3c177c8
- https://git.kernel.org/stable/c/5a3f7a683aee56e1f15c9d53041f3236767eaae7
- https://git.kernel.org/stable/c/8243d587a081e790ad96e80d48eef44d9f7ef005
- https://git.kernel.org/stable/c/ab836d56ff43f2e7927e88c83cd02c47a98a672e
- https://git.kernel.org/stable/c/b0db9f4ff402becff710ab27dbd9f6fe4850b47e
- https://git.kernel.org/stable/c/b45e8c24608c992d1e2cea047eb5bcbfa537f86b
- https://git.kernel.org/stable/c/be331b23c650de9518f8266b901d8abb9b36af77
- https://git.kernel.org/stable/c/e69d4927dacd6ddaff09777a89efc0d3143d3b0d
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.