Live › vulnerability › CVE-2026-98487
Go to dashboardA Linux kernel bridge multicast (MDB) bug frees port group entries while a cursor still points at them, so a later netlink MDB dump reads freed memory. The sources do not describe a confirmed attacker-controlled path, so the impact beyond a kernel memory read and crash is unknown.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems running a Linux kernel with the bridge multicast snooping (MDB) code in use are relevant, which typically means hosts or containers that run Linux bridges such as Docker or libvirt networks. Hosts without Linux bridges or with multicast snooping disabled are less exposed, though the sources do not state the exact trigger conditions. Local users able to issue netlink bridge requests are the most likely to reach it.
No product ranges from the sources yet.
uname -r and compare the running kernel against the fixed kernel versions in the upstream stable advisory (unknown from these sources)bridge mdb show on hosts that use Linux bridges with multicast snooping, to confirm the bridge feature is in useEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: mdb: restart port group walk after deletion
br_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking mp->ports. br_multicast_del_pg() can re-enter the same MDB entry through br_multicast_sg_del_exclude_ports() and unlink other port groups. If the cursor points into one of those groups, the next iteration dereferences a stale cursor and can leave mp->ports pointing at freed memory.
A following RTM_GETMDB exposes the dangling pointer:
BUG: KASAN: slab-use-after-free in br_mdb_dump Read of size 8 br_mdb_dump rtnl_mdb_dump rtnl_dumpit netlink_dump
Reset the cursor to mp->ports after every deletion. The deletion removes at least the selected group, so the restarted walk always makes progress.
This page as .md · .json · in your agent: get_signal("CVE-2026-98487")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.