CVE-2026-98487: net: bridge: mdb: restart port group walk after deletion

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mdb: restart port group walk after deletion

brmdbflushpgs() keeps a pointer-to-pointer cursor while walking mp->ports. brmulticastdelpg() can re-enter the same MDB entry through brmulticastsgdelexcludeports() and unlink other port groups. If the cursor points into one of those groups, the next iteration dereferences a stale cursor and can leave mp->ports pointing at freed memory.

A following RTMGETMDB exposes the dangling pointer:

BUG: KASAN: slab-use-after-free in brmdbdump Read of size 8 brmdbdump rtnlmdbdump rtnldumpit netlinkdump

Reset the cursor to mp->ports after every deletion. The deletion removes at least the selected group, so the restarted walk always makes progress.