CVE-2026-74480

Received Received - Intake

Linux Kernel Multicast Fast-Leave Use-After-Free

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry. If multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group with different source MAC addresses. Once multicast-to-unicast is disabled, br_port_group_equal() matches those entries by port only. A fast leave can then delete one entry and continue from its stale next pointer, leaving mp->ports pointing at a deleted port group. Fast leave only needs to remove one matching port group. Break after br_multicast_del_pg() so the loop stops before dereferencing the removed entry.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-05

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74480

EUVD

EUVD-2026-59673

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the bridge module's multicast leave group handling. When a port group is deleted during a fast-leave operation, the loop continues to iterate over a stale pointer, potentially leaving the bridge with a corrupted port group list. This can lead to incorrect behavior in multicast traffic handling.

Detection Guidance

This vulnerability affects the Linux kernel's bridge multicast handling. Detection requires checking kernel logs for bridge-related errors or crashes, particularly after multicast-to-unicast mode changes. Inspect bridge port groups with commands like 'bridge multicast' or 'ip maddr show'. Monitor for kernel panics or bridge subsystem failures.

Impact Analysis

If exploited, this vulnerability could cause network disruptions in systems using Linux kernel bridge functionality with multicast-to-unicast enabled. It may lead to incorrect multicast traffic forwarding, potential denial of service, or unauthorized network access depending on the system configuration.

Compliance Impact

This vulnerability affects network bridging in the Linux kernel and does not directly relate to data protection standards like GDPR or HIPAA. It involves multicast group handling in network bridges, which is unrelated to compliance requirements for data privacy or security controls.

Mitigation Strategies

Apply the latest Linux kernel patches from your distribution. Disable multicast-to-unicast bridging if not required. Restart affected bridge interfaces. Monitor kernel logs for bridge-related errors after changes. Consider temporarily disabling bridge fast-leave until patched.

Hi! I’m here to help you understand CVE-2026-74480. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70