UBUNTU-CVE-2026-98487: Use After Free

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion brmdbflushpgs() keeps a pointer-to-pointer cursor while walking mp->ports. brmulticastdelpg() can re-enter the same MDB entry through brmulticastsgdelexcludeports() and unlink other port groups. If the cursor points into one of those groups, the next iteration dereferences a stale cursor and can leave mp->ports pointing at freed memory. A following RTMGETMDB exposes the dangling pointer: BUG: KASAN: slab-use-after-free in brmdbdump Read of size 8 brmdbdump rtnlmdbdump rtnldumpit netlinkdump Reset the cursor to mp->ports after every deletion. The deletion removes at least the selected group, so the restarted walk always makes progress.