CVE-2026-98487 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: mdb: restart port group walk after deletion
br_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking mp->ports. br_multicast_del_pg() can re-enter the same MDB entry through br_multicast_sg_del_exclude_ports() and unlink other port groups. If the cursor points into one of those groups, the next iteration dereferences a stale cursor and can leave mp->ports pointing at freed memory.
A following RTM_GETMDB exposes the dangling pointer:
BUG: KASAN: slab-use-after-free in br_mdb_dump Read of size 8 br_mdb_dump rtnl_mdb_dump rtnl_dumpit netlink_dump
Reset the cursor to mp->ports after every deletion. The deletion removes at least the selected group, so the restarted walk always makes progress.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in the Linux kernel's bridge multicast database implementation represents a critical use-after-free condition arising from improper handling of linked list cursors during concurrent modification operations. Specifically, within the net: bridge subsystem, the function br_mdb_flush_pgs maintains a pointer-to-pointer cursor to traverse the mp->ports structure while iterating through port groups associated with a multicast group entry. The core technical flaw occurs when the deletion process invokes br_multicast_del_pg, which in turn calls br_multicast_sg_del_exclude_ports. This nested call sequence can re-enter the same MDB (Multicast Database) entry and unlink other port groups from the list structure while the outer loop is still holding a stale reference to those elements. Because the cursor was initialized based on the initial state of the linked list, any structural changes caused by the recursive deletion result in the cursor pointing to memory that has already been freed or removed from the active chain.
This architectural oversight leads directly to a slab-use-after-free condition as described in Kernel Address Sanitizer reports. When the iteration continues after such a deletion event, the code attempts to dereference the stale pointer stored in the cursor variable. Since the targeted port group may have been deallocated by the kernel's memory management subsystem during the unlinking process, this dereference accesses invalid memory space. The vulnerability is particularly dangerous because it can be triggered through standard network configuration commands and subsequently exploited via RTM_GETMDB netlink messages. An attacker or a misconfigured system component that triggers this sequence causes the kernel to read from freed slab objects, leading to unpredictable behavior ranging from data corruption to complete kernel panic or denial of service conditions due to the resulting BUG: KASAN error.
From an operational impact perspective, this vulnerability affects systems relying on Linux bridge multicast routing features. While exploitation typically requires local access to trigger specific netlink operations that manipulate multicast group memberships, the severity is heightened by the fact that it involves core networking infrastructure code. The ability to cause a kernel crash through standard administrative commands means that any user with sufficient privileges to modify bridge MDB entries can destabilize the host system. Furthermore, in virtualized environments or container orchestration platforms where network namespaces are frequently manipulated, this flaw could potentially be leveraged for more sophisticated attacks if combined with other vulnerabilities to achieve arbitrary code execution via heap corruption techniques, although the primary immediate impact is stability degradation through kernel oopses and panics.
The remediation strategy implemented in the patch addresses the root cause by resetting the cursor back to mp->ports after every deletion operation within br_mdb_flush_pgs. This approach ensures that any subsequent iteration restarts from a valid, current head of the list rather than continuing with a potentially dangling pointer derived from an outdated structural state. By forcing the walk to always make progress and re-evaluate the list structure post-modification, the code avoids accessing memory associated with removed groups. To mitigate this risk in environments where patching may not be immediately feasible, administrators should restrict access to netlink multicast database modification commands to trusted users only. Additionally, monitoring for kernel log entries related to KASAN slab-use-after-free errors can serve as an early warning system for potential exploitation attempts or accidental triggers of this flaw within the network stack infrastructure.
This vulnerability aligns with CWE-416, Use After Free, which describes situations where a program continues to use a pointer after it has been freed, leading to undefined behavior and security risks. In terms of attack vector classification under MITRE ATT&CK for Enterprise or ICS, this falls under Taint Analysis failures within the system software layer, specifically relating to improper validation of resource lifecycles during dynamic memory management operations in network drivers. The incident underscores the complexity of maintaining consistency in doubly linked lists when recursive modifications are permitted and highlights the necessity of defensive programming practices such as cursor invalidation or re-initialization after structural changes in kernel-space data structures.