CVE-2026-74480

A flaw was found in the Linux kernel's network bridge module. When handling multicast fast-leave, a vulnerability exists where the system may attempt to access a port group after it has been deleted. This can occur if multicast-to-unicast was previously enabled and then disabled, leading to a stale pointer. This memory corruption vulnerability could lead to system instability or a denial of service.

If the multicast-to-unicast feature has not been explicitly enabled on any bridge port (it is disabled by default), the vulnerable code path cannot be reached. Systems that do not use Linux bridge interfaces - for example, systems that are not acting as hypervisors, container hosts, or network gateways - are not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If bridge multicast snooping is not required, it can be disabled to prevent the vulnerable code path from being reached:

echo 0 > /sys/class/net/<bridge>/bridge/multicast_snooping

The br_multicast_leave_group() code path is only reachable when multicast snooping is active, so disabling it eliminates exposure to this flaw.

Alternatively, avoid toggling multicast_to_unicast on bridge ports after it has been enabled. If multicast snooping is required, ensure that multicast_to_unicast is either left at its default (disabled) or, once enabled on a port, is not subsequently disabled while the port has active multicast group memberships.