CVE-2026-74480 (GCVE-0-2026-74480)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:37
VLAI
Title
net: bridge: stop fast-leave after deleting a port group
Summary
In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry. If multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group with different source MAC addresses. Once multicast-to-unicast is disabled, br_port_group_equal() matches those entries by port only. A fast leave can then delete one entry and continue from its stale next pointer, leaving mp->ports pointing at a deleted port group. Fast leave only needs to remove one matching port group. Break after br_multicast_del_pg() so the loop stops before dereferencing the removed entry.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 6db6f0eae6052b70885562e1733896647ec1d807 , < d6c32e2e25a9a06ba021030e26b6d602a277eb72 (git)
Affected: 6db6f0eae6052b70885562e1733896647ec1d807 , < 482bcb85139addb4e8ac8ed10baeda3e0aad4031 (git)
Affected: 6db6f0eae6052b70885562e1733896647ec1d807 , < 1a109cc9890d017c41d77e6c82da739579c49f0b (git)
Affected: 6db6f0eae6052b70885562e1733896647ec1d807 , < 159ad90cb929c033308bb39a2c5f8fbf393b77aa (git)
Affected: 6db6f0eae6052b70885562e1733896647ec1d807 , < 4695430e8132420bf8de94da3eb36a6cf35fde6b (git)
Affected: 6db6f0eae6052b70885562e1733896647ec1d807 , < 0309ebbc570000ea0df11c06b69798e5860c5f6f (git)
Affected: 6db6f0eae6052b70885562e1733896647ec1d807 , < 4c57056ca6aace2e9f94ae9298bf49ef6b0c95e4 (git)
Affected: 6db6f0eae6052b70885562e1733896647ec1d807 , < a39789f211b8a4125f0c70e05b30cf715f4f187d (git)
Create a notification for this product.
Linux Linux Affected: 4.11
Unaffected: 0 , < 4.11 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_multicast.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d6c32e2e25a9a06ba021030e26b6d602a277eb72",
              "status": "affected",
              "version": "6db6f0eae6052b70885562e1733896647ec1d807",
              "versionType": "git"
            },
            {
              "lessThan": "482bcb85139addb4e8ac8ed10baeda3e0aad4031",
              "status": "affected",
              "version": "6db6f0eae6052b70885562e1733896647ec1d807",
              "versionType": "git"
            },
            {
              "lessThan": "1a109cc9890d017c41d77e6c82da739579c49f0b",
              "status": "affected",
              "version": "6db6f0eae6052b70885562e1733896647ec1d807",
              "versionType": "git"
            },
            {
              "lessThan": "159ad90cb929c033308bb39a2c5f8fbf393b77aa",
              "status": "affected",
              "version": "6db6f0eae6052b70885562e1733896647ec1d807",
              "versionType": "git"
            },
            {
              "lessThan": "4695430e8132420bf8de94da3eb36a6cf35fde6b",
              "status": "affected",
              "version": "6db6f0eae6052b70885562e1733896647ec1d807",
              "versionType": "git"
            },
            {
              "lessThan": "0309ebbc570000ea0df11c06b69798e5860c5f6f",
              "status": "affected",
              "version": "6db6f0eae6052b70885562e1733896647ec1d807",
              "versionType": "git"
            },
            {
              "lessThan": "4c57056ca6aace2e9f94ae9298bf49ef6b0c95e4",
              "status": "affected",
              "version": "6db6f0eae6052b70885562e1733896647ec1d807",
              "versionType": "git"
            },
            {
              "lessThan": "a39789f211b8a4125f0c70e05b30cf715f4f187d",
              "status": "affected",
              "version": "6db6f0eae6052b70885562e1733896647ec1d807",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_multicast.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: stop fast-leave after deleting a port group\n\nbr_multicast_leave_group() iterates mp-\u003eports with pp = \u0026p-\u003enext in\nits fast-leave path. After br_multicast_del_pg() removes p,\ncontinuing the loop advances pp through the deleted entry.\n\nIf multicast-to-unicast was enabled, the bridge can hold multiple port\ngroups for the same port and group with different source MAC\naddresses. Once multicast-to-unicast is disabled,\nbr_port_group_equal() matches those entries by port only. A fast leave\ncan then delete one entry and continue from its stale next pointer,\nleaving mp-\u003eports pointing at a deleted port group.\n\nFast leave only needs to remove one matching port group. Break after\nbr_multicast_del_pg() so the loop stops before dereferencing the\nremoved entry."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached when the bridge network stack processes attacker-supplied IGMP/MLD Leave packets received on a bridge port (br_handle_frame_finish -\u003e br_multicast_rcv -\u003e br_ip4/ip6_multicast_leave_group -\u003e br_multicast_leave_group), requiring no local syscall access.\nAC:L - Once a bridge has IGMP snooping, fast-leave, and leftover duplicate port groups (common on WiFi APs that used multicast-to-unicast), an attacker can reliably trigger the bug by sending IGMP/MLD joins then a Leave; no uncontrollable race or rare timing is required.\nPR:N - No privileges or authentication are required on the target; any host on an attached bridge port can inject IGMP/MLD Leave packets that are processed and reach the vulnerable fast-leave deletion loop.\nUI:N - Exploitation requires only attacker-sent multicast control packets; no victim user action such as opening files, clicking links, or mounting filesystems is needed.\nS:U - Impact is kernel heap corruption and use-after-free within the bridge/multicast subsystem on the same host; it does not cross a VM/hypervisor or IOMMU security boundary by itself.\nC:H - Deleting a port group then continuing the list walk dereferences freed net_bridge_port_group memory and can leave mp-\u003eports dangling, giving a use-after-free read primitive exploitable for arbitrary kernel memory disclosure.\nI:H - Corrupting the mp-\u003eports linked list via stale next pointers after br_multicast_del_pg() enables attacker-influenced kernel heap corruption that can be developed into arbitrary write and privilege escalation.\nA:H - The use-after-free and corrupted multicast database pointers cause kernel oops/panics when subsequent bridge multicast forwarding or MDB operations traverse the broken port-group list, enabling repeatable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:37:33.031Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d6c32e2e25a9a06ba021030e26b6d602a277eb72"
        },
        {
          "url": "https://git.kernel.org/stable/c/482bcb85139addb4e8ac8ed10baeda3e0aad4031"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a109cc9890d017c41d77e6c82da739579c49f0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/159ad90cb929c033308bb39a2c5f8fbf393b77aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/4695430e8132420bf8de94da3eb36a6cf35fde6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/0309ebbc570000ea0df11c06b69798e5860c5f6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c57056ca6aace2e9f94ae9298bf49ef6b0c95e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/a39789f211b8a4125f0c70e05b30cf715f4f187d"
        }
      ],
      "title": "net: bridge: stop fast-leave after deleting a port group",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74480",
    "datePublished": "2026-08-15T12:27:13.803Z",
    "dateReserved": "2026-08-15T05:44:03.904Z",
    "dateUpdated": "2026-08-19T16:37:33.031Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74480",
      "date": "2026-10-10",
      "epss": "0.00579",
      "percentile": "0.46029"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/bridge/br_multicast.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d6c32e2e25a9a06ba021030e26b6d602a277eb72",
                    "status": "affected",
                    "version": "6db6f0eae6052b70885562e1733896647ec1d807",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "482bcb85139addb4e8ac8ed10baeda3e0aad4031",
                    "status": "affected",
                    "version": "6db6f0eae6052b70885562e1733896647ec1d807",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1a109cc9890d017c41d77e6c82da739579c49f0b",
                    "status": "affected",
                    "version": "6db6f0eae6052b70885562e1733896647ec1d807",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "159ad90cb929c033308bb39a2c5f8fbf393b77aa",
                    "status": "affected",
                    "version": "6db6f0eae6052b70885562e1733896647ec1d807",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4695430e8132420bf8de94da3eb36a6cf35fde6b",
                    "status": "affected",
                    "version": "6db6f0eae6052b70885562e1733896647ec1d807",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0309ebbc570000ea0df11c06b69798e5860c5f6f",
                    "status": "affected",
                    "version": "6db6f0eae6052b70885562e1733896647ec1d807",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4c57056ca6aace2e9f94ae9298bf49ef6b0c95e4",
                    "status": "affected",
                    "version": "6db6f0eae6052b70885562e1733896647ec1d807",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a39789f211b8a4125f0c70e05b30cf715f4f187d",
                    "status": "affected",
                    "version": "6db6f0eae6052b70885562e1733896647ec1d807",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/bridge/br_multicast.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.11"
                  },
                  {
                    "lessThan": "4.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: stop fast-leave after deleting a port group\n\nbr_multicast_leave_group() iterates mp-\u003eports with pp = \u0026p-\u003enext in\nits fast-leave path. After br_multicast_del_pg() removes p,\ncontinuing the loop advances pp through the deleted entry.\n\nIf multicast-to-unicast was enabled, the bridge can hold multiple port\ngroups for the same port and group with different source MAC\naddresses. Once multicast-to-unicast is disabled,\nbr_port_group_equal() matches those entries by port only. A fast leave\ncan then delete one entry and continue from its stale next pointer,\nleaving mp-\u003eports pointing at a deleted port group.\n\nFast leave only needs to remove one matching port group. Break after\nbr_multicast_del_pg() so the loop stops before dereferencing the\nremoved entry."
          }
        ],
        "id": "CVE-2026-74480",
        "lastModified": "2026-08-19T17:21:05.127",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T13:17:52.820",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0309ebbc570000ea0df11c06b69798e5860c5f6f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/159ad90cb929c033308bb39a2c5f8fbf393b77aa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1a109cc9890d017c41d77e6c82da739579c49f0b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4695430e8132420bf8de94da3eb36a6cf35fde6b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/482bcb85139addb4e8ac8ed10baeda3e0aad4031"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4c57056ca6aace2e9f94ae9298bf49ef6b0c95e4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a39789f211b8a4125f0c70e05b30cf715f4f187d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d6c32e2e25a9a06ba021030e26b6d602a277eb72"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-29T15:58:11+00:00",
      "cve": "CVE-2026-74480",
      "id": "CVE-2026-74480",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:fixed": "2191",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: bridge: stop fast-leave after deleting a port group",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74480.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-10-08T17:02:42Z",
      "cve": "CVE-2026-74480",
      "id": "CVE-2026-74480",
      "initial_release_date": "2026-08-15T23:52:05Z",
      "product_status:known_affected": "392",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "116",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74480",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74480.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.