Description

In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry. If multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group with different source MAC addresses. Once multicast-to-unicast is disabled, br_port_group_equal() matches those entries by port only. A fast leave can then delete one entry and continue from its stale next pointer, leaving mp->ports pointing at a deleted port group. Fast leave only needs to remove one matching port group. Break after br_multicast_del_pg() so the loop stops before dereferencing the removed entry.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-15T13:17:52.820Z",
  "pubdate": "2026-08-15T13:17:52.820Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel network bridge multicast implementation, specifically within the fast-leave processing path of br_multicast_leave_group(). The flaw is categorized as an improper pointer management issue leading to memory corruption or undefined behavior.\nThe vulnerability impacts Linux kernel systems utilizing network bridge multicast-to-unicast configurations where multicast port groups are dynamically managed and deleted.\nAn attacker or system process capable of manipulating network bridge multicast groups and triggering fast-leave operations can exploit this flaw to cause kernel memory corruption.\nSuccessful exploitation requires local network interaction or the ability to trigger specific multicast group leave sequences under conditions where multiple port groups share port mappings due to state transitions in multicast-to-unicast modes.\nThe risk implications involve potential denial of service through kernel crashes or unintended memory manipulation within the networking subsystem, undermining overall system stability and integrity.",
  "technicalDetails": "The vulnerability resides in the Linux kernel networking subsystem, specifically within the bridge multicast handling logic in br_multicast_leave_group() and its interaction with port group deletion functions such as br_multicast_del_pg().\nThe root cause stems from incorrect pointer traversal during the fast-leave path iteration over mp->ports using pp = &p->next. When br_multicast_del_pg() removes a port group entry p, the loop continues and advances pp through the already deleted entry.\nThis condition is exacerbated when multicast-to-unicast is disabled, causing the bridge to hold multiple port groups for the same port and group distinguished by different source MAC addresses. When br_port_group_equal() matches these entries by port only, a fast-leave operation deletes one entry while retaining a stale next pointer in mp->ports.\nThe step-by-step attack flow begins when an administrator or automated state change disables multicast-to-unicast, aligning multiple port group entries by port mapping. Subsequently, a fast-leave IGMP/MLD message or local action invokes br_multicast_leave_group(), which iterates through the port group list.\nDuring iteration, br_multicast_del_pg() deletes the targeted port group, but the loop fails to terminate. The execution flow advances through the freed memory region or dereferences the stale next pointer, leaving mp->ports referencing a deallocated port group.\nThis invalid pointer dereference leads to kernel memory corruption, potential kernel panics, or use-after-free conditions depending on subsequent memory reallocations and kernel heap state.\nThe affected component is the Linux kernel bridge multicast module. Exploitation does not explicitly require authentication if triggered via standard network protocol interactions, but depends on specific local bridge configurations and timing of multicast group leave events."
}