Use-after-free in Linux kernel - CVE-2026-98487

Vulnerability details

The vulnerability allows a local privileged user to cause a denial of service by potentially crashing the kernel.

The vulnerability exists due to a use-after-free in the Linux kernel bridge multicast database code when deleting multicast port groups. A local privileged user can trigger port group deletion followed by an RTM_GETMDB request to cause an access to freed memory and potentially crash the kernel. Reentrant deletion can unlink other port groups, invalidating the traversal cursor in br_mdb_flush_pgs() and leaving the port list pointing to freed memory that br_mdb_dump() subsequently reads.

Affected software

How to mitigate CVE-2026-98487

External References

• https://git.kernel.org/stable/c/46ec55855c972504258c371677ac039ba20e5d12
• https://git.kernel.org/stable/c/ab1404ac81154a89fb61ac50ae9a04cd8d4834dc
• https://git.kernel.org/stable/c/ab3c4a4c85f2e1e8d04b5c1770dea8412d21c7fe
• https://git.kernel.org/stable/c/fe2a42789c12eb7c5d3a42191e2cc735a6c35ead

Related Security Bulletins

• Use-after-free in Linux kernel bridge
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more