CVE-2026-74480 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: stop fast-leave after deleting a port group
br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry.
If multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group with different source MAC addresses. Once multicast-to-unicast is disabled, br_port_group_equal() matches those entries by port only. A fast leave can then delete one entry and continue from its stale next pointer, leaving mp->ports pointing at a deleted port group.
Fast leave only needs to remove one matching port group. Break after br_multicast_del_pg() so the loop stops before dereferencing the removed entry.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists in the linux kernel's bridge multicast implementation where a use-after-free condition can occur during multicast group management operations. The issue manifests when the br_multicast_leave_group function processes multicast fast-leave operations and subsequently removes port groups from the multicast group structure. The core technical flaw involves improper iteration control within the fast-leave code path where the loop continues to advance through a stale pointer after an entry has been removed from the linked list structure.
The vulnerability stems from the iteration pattern where pp = &p->next is used to traverse mp->ports, but when br_multicast_del_pg() removes a specific port group entry, the subsequent loop continuation advances pp through what is now a freed memory location. This creates a classic use-after-free scenario that can lead to memory corruption and potential privilege escalation. The problem becomes particularly severe when multicast-to-unicast translation is enabled, as this allows multiple port groups for the same multicast group but with different source MAC addresses, creating complex state management requirements.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially enable arbitrary code execution within the kernel context. Attackers could exploit this weakness by triggering multicast fast-leave operations on bridges configured with multicast-to-unicast translation, leading to a denial of service or privilege escalation depending on the specific system configuration and attack vector employed. The vulnerability affects systems running linux kernel versions where bridge multicast functionality is enabled and used in network configurations that support multicast traffic forwarding.
The fix implemented addresses this by adding an early break statement after br_multicast_del_pg() execution, preventing the loop from continuing to dereference the recently deleted port group entry. This modification ensures proper iteration control and prevents the use-after-free condition. Security practitioners should note that this vulnerability aligns with CWE-416 Use After Free and follows patterns commonly seen in kernel networking stack vulnerabilities. The ATT&CK framework would categorize this under privilege escalation techniques, specifically leveraging kernel memory corruption vulnerabilities to gain elevated privileges.
This type of vulnerability demonstrates the complexity inherent in kernel network stack implementations where multiple concurrent operations must be carefully synchronized to prevent race conditions and memory management errors. The issue highlights the importance of proper pointer validation and iteration control in kernel code, particularly when dealing with dynamic data structures like linked lists that undergo modification during traversal operations. System administrators should prioritize applying kernel updates containing this fix, especially on systems operating bridge networks with multicast functionality enabled, as the vulnerability represents a significant security risk that could be exploited to compromise entire network infrastructure components.