CVE-2026-98487

A flaw was found in the Linux kernel's network bridge subsystem. When deleting multicast database (MDB) port groups, the kernel can maintain a stale reference to memory that has already been freed during recursive group removal, resulting in a use-after-free condition. A local attacker could exploit this vulnerability through bridge management operations to trigger a system crash, leading to a Denial of Service (DoS), or potentially achieve privilege escalation.

A use after free in the bridge MDB control path can occur because br_mdb_flush_pgs keeps a pointer to pointer cursor while br_multicast_del_pg can reenter the same MDB entry and remove additional port groups. If the cursor points into one of the deleted groups, the next iteration dereferences freed memory and mp ports may retain a dangling list pointer. A following local RTM_GETMDB request can reach the stale pointer in br_mdb_dump and cause a kernel crash. For the CVSS the PR:L reflects that triggering requires local MDB management access, commonly through CAP_NET_ADMIN in a network namespace or a delegated container context. The issue is not directly reachable through ordinary remote bridge traffic because the demonstrated trigger uses the local netlink control plane. Impact is at least denial of service through a kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.