CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: stop fast-leave after deleting a port group
brmulticastleavegroup() iterates mp->ports with pp = &p->next in its fast-leave path. After brmulticastdelpg() removes p, continuing the loop advances pp through the deleted entry.
If multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group with different source MAC addresses. Once multicast-to-unicast is disabled, brportgroupequal() matches those entries by port only. A fast leave can then delete one entry and continue from its stale next pointer, leaving mp->ports pointing at a deleted port group.
Fast leave only needs to remove one matching port group. Break after brmulticastdelpg() so the loop stops before dereferencing the removed entry.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74480?
The severity of CVE-2026-74480 is rated as 34.
How do I fix CVE-2026-74480?
To fix CVE-2026-74480, update to the latest version of the Linux kernel where the vulnerability has been resolved.
What systems are affected by CVE-2026-74480?
CVE-2026-74480 affects Linux kernel systems that utilize bridging features.
What does CVE-2026-74480 exploit?
CVE-2026-74480 exploits a flaw in the fast-leave functionality after deleting a port group in the Linux kernel bridge.
Is CVE-2026-74480 remotely exploitable?
CVE-2026-74480 may allow for local privilege escalation under certain conditions, but it is not primarily categorized as remotely exploitable.