CVE-2026-74480

net: bridge: stop fast-leave after deleting a port group

State: Published
Severity: 9.8 Critical
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: stop fast-leave after deleting a port group

br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry.

If multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group with different source MAC addresses. Once multicast-to-unicast is disabled, br_port_group_equal() matches those entries by port only. A fast leave can then delete one entry and continue from its stale next pointer, leaving mp->ports pointing at a deleted port group.

Fast leave only needs to remove one matching port group. Break after br_multicast_del_pg() so the loop stops before dereferencing the removed entry.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	6db6f0eae6052b70885562e1733896647ec1d807 to before d6c32e2e25a9a06ba021030e26b6d602a277eb72Affected 6db6f0eae6052b70885562e1733896647ec1d807 to before 482bcb85139addb4e8ac8ed10baeda3e0aad4031Affected 6db6f0eae6052b70885562e1733896647ec1d807 to before 1a109cc9890d017c41d77e6c82da739579c49f0bAffected 6db6f0eae6052b70885562e1733896647ec1d807 to before 159ad90cb929c033308bb39a2c5f8fbf393b77aaAffected 6db6f0eae6052b70885562e1733896647ec1d807 to before 4695430e8132420bf8de94da3eb36a6cf35fde6bAffected 6db6f0eae6052b70885562e1733896647ec1d807 to before 0309ebbc570000ea0df11c06b69798e5860c5f6fAffected 6db6f0eae6052b70885562e1733896647ec1d807 to before 4c57056ca6aace2e9f94ae9298bf49ef6b0c95e4Affected 6db6f0eae6052b70885562e1733896647ec1d807 to before a39789f211b8a4125f0c70e05b30cf715f4f187dAffected
LinuxLinux	4.11Affected before 4.11Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.151 through 6.6.Not affected 6.12.103 through 6.12.Not affected 6.18.44 through 6.18.Not affected 7.1.8 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

6db6f0eae6052b70885562e1733896647ec1d807 to before d6c32e2e25a9a06ba021030e26b6d602a277eb72Affected
6db6f0eae6052b70885562e1733896647ec1d807 to before 482bcb85139addb4e8ac8ed10baeda3e0aad4031Affected
6db6f0eae6052b70885562e1733896647ec1d807 to before 1a109cc9890d017c41d77e6c82da739579c49f0bAffected
6db6f0eae6052b70885562e1733896647ec1d807 to before 159ad90cb929c033308bb39a2c5f8fbf393b77aaAffected
6db6f0eae6052b70885562e1733896647ec1d807 to before 4695430e8132420bf8de94da3eb36a6cf35fde6bAffected
6db6f0eae6052b70885562e1733896647ec1d807 to before 0309ebbc570000ea0df11c06b69798e5860c5f6fAffected
6db6f0eae6052b70885562e1733896647ec1d807 to before 4c57056ca6aace2e9f94ae9298bf49ef6b0c95e4Affected
6db6f0eae6052b70885562e1733896647ec1d807 to before a39789f211b8a4125f0c70e05b30cf715f4f187dAffected

LinuxLinux

4.11Affected
before 4.11Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.151 through 6.6.*Not affected
6.12.103 through 6.12.*Not affected
6.18.44 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.