{"id":"CVE-2026-98487","kind":"vulnerability","aliases":["CVE-2026-98487"],"related":[],"title":"Linux kernel: bridge multicast group deletion leaves a dangling pointer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mdb: restart port group walk after deletion\n\nbr_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking\nmp->ports. br_multicast_del_pg() can re-enter the same MDB entry through\nbr_multicast_sg_del_exclude_ports() and unlink other port groups. If the\ncursor points into one of those groups, the next iteration dereferences a\nstale cursor and can leave mp->ports pointing at freed memory.\n\nA following RTM_GETMDB exposes the dangling pointer:\n\n  BUG: KASAN: slab-use-after-free in br_mdb_dump\n  Read of size 8\n    br_mdb_dump\n    rtnl_mdb_dump\n    rtnl_dumpit\n    netlink_dump\n\nReset the cursor to mp->ports after every deletion. The deletion removes at\nleast the selected group, so the restarted walk always makes progress.","summary":"A Linux kernel bridge multicast (MDB) bug frees port group entries while a cursor still points at them, so a later netlink MDB dump reads freed memory. The sources do not describe a confirmed attacker-controlled path, so the impact beyond a kernel memory read and crash is unknown.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bridge","kubernetes","linux-kernel","networking","package","self-hosted"],"not_affected_if":["multicast-snooping-disabled","no-linux-bridge"],"how_to_check":"- `uname -r` and compare the running kernel against the fixed kernel versions in the upstream stable advisory (unknown from these sources)\n- `bridge mdb show` on hosts that use Linux bridges with multicast snooping, to confirm the bridge feature is in use","fix":"- Update to a Linux kernel release that includes the upstream commit 'net: bridge: mdb: restart port group walk after deletion' (exact fixed version unknown from these sources)\n- Reboot after the kernel update so the fixed code is running","status":"open","published_at":"2026-10-18T16:16:59+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:46+00:00","updated_at":"2026-10-25T05:25:46+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:25:46Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit 'net: bridge: mdb: restart port group walk after deletion' (exact fixed version unknown from these sources)\n- Reboot after the kernel update so the fixed code is running","reach":"local","title":"Linux kernel: bridge multicast group deletion leaves a dangling pointer","impact":"medium","summary":"A Linux kernel bridge multicast (MDB) bug frees port group entries while a cursor still points at them, so a later netlink MDB dump reads freed memory. The sources do not describe a confirmed attacker-controlled path, so the impact beyond a kernel memory read and crash is unknown.","category":"package","nicknames":[],"who_cares":["linux-kernel","bridge","networking","self-hosted","kubernetes"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory is read after free, possibly crashing the host","analyst_note":"Check the NVD entry and the upstream kernel stable commit for affected and fixed versions, and whether an unprivileged user can trigger the deletion path.","how_to_check":"- `uname -r` and compare the running kernel against the fixed kernel versions in the upstream stable advisory (unknown from these sources)\n- `bridge mdb show` on hosts that use Linux bridges with multicast snooping, to confirm the bridge feature is in use","needs_analyst":true,"not_affected_if":["no-linux-bridge","multicast-snooping-disabled"],"who_is_affected":"Only systems running a Linux kernel with the bridge multicast snooping (MDB) code in use are relevant, which typically means hosts or containers that run Linux bridges such as Docker or libvirt networks. Hosts without Linux bridges or with multicast snooping disabled are less exposed, though the sources do not state the exact trigger conditions. Local users able to issue netlink bridge requests are the most likely to reach it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000707,"input_tokens":3543,"output_tokens":705,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98487':13A,16A '8':182C 'alway':214C 'attack':62B 'attacker-control':61B 'beyond':68B 'br':96C,111C,124C,176C,183C 'bridg':3A,17B,30B,88C 'bug':33B,168C 'confirm':60B 'control':63B 'crash':74B 'cursor':40B,106C,137C,150C,195C 'cve':11A,14A 'dangl':9A,166C 'del':113C,127C 'delet':6A,95C,201C,203C 'derefer':147C 'describ':58B 'dump':50B,178C,185C,188C,192C 'dumpit':190C 'enter':118C 'entri':37B,122C 'everi':200C 'exclud':128C 'expos':164C 'flush':98C 'follow':82C,161C 'free':34B,174C 'freed':52B,158C 'getmdb':163C 'group':5A,36B,92C,134C,143C,209C 'host':26B 'impact':67B 'iter':146C 'kasan':169C 'keep':100C 'kernel':2A,21B,29B,70B,80C 'kubernet':18B 'later':47B 'least':206C 'leav':7A,153C 'linux':1A,20B,28B,79C 'linux-kernel':19B 'make':215C 'mdb':32B,49B,89C,97C,121C,177C,184C,187C 'memori':53B,71B,159C 'mp':109C,154C,197C 'multicast':4A,31B,112C,125C 'net':87C 'netlink':48B,191C 'network':22B 'next':145C 'one':140C 'packag':23B 'path':64B 'pg':114C 'pgs':99C 'point':42B,138C,156C 'pointer':10A,103C,105C,167C 'pointer-to-point':102C 'port':35B,91C,110C,129C,133C,155C,198C 'progress':216C 're':117C 're-ent':116C 'read':51B,72B,179C 'remov':204C 'reset':193C 'resolv':86C 'restart':90C,212C 'rtm':162C 'rtnl':186C,189C 'select':208C 'self':25B 'self-host':24B 'sg':126C 'size':181C 'slab':171C 'slab-use-after-fre':170C 'sourc':55B 'stale':149C 'still':41B 'unknown':76B 'unlink':131C 'use':172C 'vulner':83C 'walk':93C,108C,213C","nicknames":[],"mitigations":[],"who_affected":"Only systems running a Linux kernel with the bridge multicast snooping (MDB) code in use are relevant, which typically means hosts or containers that run Linux bridges such as Docker or libvirt networks. Hosts without Linux bridges or with multicast snooping disabled are less exposed, though the sources do not state the exact trigger conditions. Local users able to issue netlink bridge requests are the most likely to reach it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98487","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98487","severity":null,"published_at":"2026-10-18T16:16:59+00:00","modified_at":"2026-10-19T10:19:00+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}