CVE-2026-98026

A flaw was found in the Linux kernel's network bridge subsystem. An attacker could exploit this vulnerability to cause a Denial of Service (DoS) or system crash through a use-after-free condition. This issue occurs during multicast port group removal, where the kernel immediately frees data structures without waiting for concurrent list readers to finish processing.

A moderate-impact use-after-free flaw was found in the Linux kernel's network bridge multicast implementation in net/bridge/br_multicast.c. The br_multicast_del_port_group() function unlists a bridge multicast port group without using an RCU-safe helper that preserves the next pointer and then immediately frees the port group without waiting for an RCU grace period. A concurrent reader of the multicast group list, such as br_multicast_list_adjacent(), can then dereference already-freed memory, causing a kernel crash and resulting in denial of service. Red Hat rates this flaw as Moderate severity (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H): exploitation requires the ability to trigger multicast port-group removal and win a race with a concurrent list traversal, and the confirmed impact is loss of availability only, with no direct impact on confidentiality or integrity. The kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10, the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS 2, and the RHEL CoreOS 8 and 9 kernels shipped with OpenShift Container Platform 4.12 through 4.23 and 5.x are affected. The fix is currently deferred for these products: this is a long-standing race condition with limited practical exploitability whose impact is limited to denial of service, so it is planned to be addressed in a future scheduled update rather than an immediate erratum; the residual risk is that an attacker able to trigger the race could crash the system. Red Hat Enterprise Linux 6 is affected but is out of support scope, so no fix is planned for it.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream Linux kernel CVE team recommends updating to the latest stable kernel version, as individual fix commits are not tested or supported in isolation.