CVE-2026-74480net: bridge: stop fast-leave after deleting a port group
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry. If multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group with different source MAC addresses. Once multicast-to-unicast is disabled, br_port_group_equal() matches those entries by port only. A fast leave can then delete one entry and continue from its stale next pointer, leaving mp->ports pointing at a deleted port group. Fast leave only needs to remove one matching port group. Break after br_multicast_del_pg() so the loop stops before dereferencing the removed entry.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 6db6f0eae6052b70885562e1733896647ec1d807 before d6c32e2e25a9a06ba021030e26b6d602a277eb72; from 6db6f0eae6052b70885562e1733896647ec1d807 before 482bcb85139addb4e8ac8ed10baeda3e0aad4031; 6db6f0eae6052b70885562e1733896647ec1d807 builds before 1a109cc9890d017c41d77e6c82da739579c49f0b; from 6db6f0eae6052b70885562e1733896647ec1d807 before 159ad90cb929c033308bb39a2c5f8fbf393b77aa; from 6db6f0eae6052b70885562e1733896647ec1d807 before 4695430e8132420bf8de94da3eb36a6cf35fde6b; from 6db6f0eae6052b70885562e1733896647ec1d807 before 0309ebbc570000ea0df11c06b69798e5860c5f6f; 6db6f0eae6052b70885562e1733896647ec1d807 builds before 4c57056ca6aace2e9f94ae9298bf49ef6b0c95e4; from 6db6f0eae6052b70885562e1733896647ec1d807 before a39789f211b8a4125f0c70e05b30cf715f4f187d | CNA record |
References
- https://git.kernel.org/stable/c/d6c32e2e25a9a06ba021030e26b6d602a277eb72
- https://git.kernel.org/stable/c/482bcb85139addb4e8ac8ed10baeda3e0aad4031
- https://git.kernel.org/stable/c/1a109cc9890d017c41d77e6c82da739579c49f0b
- https://git.kernel.org/stable/c/159ad90cb929c033308bb39a2c5f8fbf393b77aa
- https://git.kernel.org/stable/c/4695430e8132420bf8de94da3eb36a6cf35fde6b
- https://git.kernel.org/stable/c/0309ebbc570000ea0df11c06b69798e5860c5f6f
- https://git.kernel.org/stable/c/4c57056ca6aace2e9f94ae9298bf49ef6b0c95e4
- https://git.kernel.org/stable/c/a39789f211b8a4125f0c70e05b30cf715f4f187d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.