CVE-2026-98487: net: bridge: mdb: restart port group walk after deletion
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: mdb: restart port group walk after deletion
brmdbflushpgs() keeps a pointer-to-pointer cursor while walking mp->ports. brmulticastdelpg() can re-enter the same MDB entry through brmulticastsgdelexcludeports() and unlink other port groups. If the cursor points into one of those groups, the next iteration dereferences a stale cursor and can leave mp->ports pointing at freed memory.
A following RTMGETMDB exposes the dangling pointer:
BUG: KASAN: slab-use-after-free in brmdbdump Read of size 8 brmdbdump rtnlmdbdump rtnldumpit netlinkdump
Reset the cursor to mp->ports after every deletion. The deletion removes at least the selected group, so the restarted walk always makes progress.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In br_mdb_flush_pgs(), reset the pointer-to-pointer cursor to mp->ports after every deletion so a port-group walk does not dereference a stale cursor.
Event History
Frequently Asked Questions
What conditions are needed to trigger the use-after-free?
The affected path requires deletion of bridge multicast database port groups while walking an MDB entry's port-group list. During deletion, re-entry through br_multicast_sg_del_exclude_ports() must unlink additional port groups such that the walk cursor becomes stale.
How might the issue become visible after the stale pointer is created?
A subsequent RTM_GETMDB netlink request can expose the dangling pointer during MDB dumping, leading to a KASAN-detected slab use-after-free in br_mdb_dump.
What is the remediation implemented by the fix?
The fix resets the port-group walk cursor to mp->ports after every deletion. Because each deletion removes at least the selected group, restarting the walk continues to make progress without retaining a cursor into a removed group.