SB2026102259 - Use-after-free in Linux kernel bridge

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-98487)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by potentially crashing the kernel.

The vulnerability exists due to a use-after-free in the Linux kernel bridge multicast database code when deleting multicast port groups. A local privileged user can trigger port group deletion followed by an RTM_GETMDB request to cause an access to freed memory and potentially crash the kernel. Reentrant deletion can unlink other port groups, invalidating the traversal cursor in br_mdb_flush_pgs() and leaving the port list pointing to freed memory that br_mdb_dump() subsequently reads.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/46ec55855c972504258c371677ac039ba20e5d12
• https://git.kernel.org/stable/c/ab1404ac81154a89fb61ac50ae9a04cd8d4834dc
• https://git.kernel.org/stable/c/ab3c4a4c85f2e1e8d04b5c1770dea8412d21c7fe
• https://git.kernel.org/stable/c/fe2a42789c12eb7c5d3a42191e2cc735a6c35ead