{"id":"CVE-2026-98487","revision":"554a43e40e22484880b904b70064c745","records":[{"revision":"554a43e40e22484880b904b70064c745","observedAt":"2026-10-24T16:17:04.479+00:00","statement":{"source":"cve-program","id":"CVE-2026-98487","aliases":[],"title":"net: bridge: mdb: restart port group walk after deletion","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mdb: restart port group walk after deletion\n\nbr_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking\nmp->ports. br_multicast_del_pg() can re-enter the same MDB entry through\nbr_multicast_sg_del_exclude_ports() and unlink other port groups. If the\ncursor points into one of those groups, the next iteration dereferences a\nstale cursor and can leave mp->ports pointing at freed memory.\n\nA following RTM_GETMDB exposes the dangling pointer:\n\n  BUG: KASAN: slab-use-after-free in br_mdb_dump\n  Read of size 8\n    br_mdb_dump\n    rtnl_mdb_dump\n    rtnl_dumpit\n    netlink_dump\n\nReset the cursor to mp->ports after every deletion. The deletion removes at\nleast the selected group, so the restarted walk always makes progress.","state":0,"publishedAt":"2026-10-18T15:16:04.746+00:00","modifiedAt":"2026-10-24T14:09:03.998+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bridge/br_mdb.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"a6acb535afb2a3b688a7858f05b61f0433e480d5\",\n                            \"lessThan\": \"46ec55855c972504258c371677ac039ba20e5d12\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a6acb535afb2a3b688a7858f05b61f0433e480d5\",\n                            \"lessThan\": \"ab3c4a4c85f2e1e8d04b5c1770dea8412d21c7fe\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a6acb535afb2a3b688a7858f05b61f0433e480d5\",\n                            \"lessThan\": \"fe2a42789c12eb7c5d3a42191e2cc735a6c35ead\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a6acb535afb2a3b688a7858f05b61f0433e480d5\",\n                            \"lessThan\": \"ab1404ac81154a89fb61ac50ae9a04cd8d4834dc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bridge/br_mdb.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.55\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/46ec55855c972504258c371677ac039ba20e5d12","https://git.kernel.org/stable/c/ab3c4a4c85f2e1e8d04b5c1770dea8412d21c7fe","https://git.kernel.org/stable/c/fe2a42789c12eb7c5d3a42191e2cc735a6c35ead","https://git.kernel.org/stable/c/ab1404ac81154a89fb61ac50ae9a04cd8d4834dc"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98487","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98487","identifiers":["CVE-2026-98487"]},"retained":false,"historicalAffected":[]}],"coverage":[]}