{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98487", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.352Z", "datePublished": "2026-10-18T15:16:04.746Z", "dateUpdated": "2026-10-19T09:20:24.542Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:20:24.542Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mdb: restart port group walk after deletion\n\nbr_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking\nmp->ports. br_multicast_del_pg() can re-enter the same MDB entry through\nbr_multicast_sg_del_exclude_ports() and unlink other port groups. If the\ncursor points into one of those groups, the next iteration dereferences a\nstale cursor and can leave mp->ports pointing at freed memory.\n\nA following RTM_GETMDB exposes the dangling pointer:\n\n BUG: KASAN: slab-use-after-free in br_mdb_dump\n Read of size 8\n br_mdb_dump\n rtnl_mdb_dump\n rtnl_dumpit\n netlink_dump\n\nReset the cursor to mp->ports after every deletion. The deletion removes at\nleast the selected group, so the restarted walk always makes progress."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bridge/br_mdb.c"], "versions": [{"version": "a6acb535afb2a3b688a7858f05b61f0433e480d5", "lessThan": "46ec55855c972504258c371677ac039ba20e5d12", "status": "affected", "versionType": "git"}, {"version": "a6acb535afb2a3b688a7858f05b61f0433e480d5", "lessThan": "ab3c4a4c85f2e1e8d04b5c1770dea8412d21c7fe", "status": "affected", "versionType": "git"}, {"version": "a6acb535afb2a3b688a7858f05b61f0433e480d5", "lessThan": "fe2a42789c12eb7c5d3a42191e2cc735a6c35ead", "status": "affected", "versionType": "git"}, {"version": "a6acb535afb2a3b688a7858f05b61f0433e480d5", "lessThan": "ab1404ac81154a89fb61ac50ae9a04cd8d4834dc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bridge/br_mdb.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/46ec55855c972504258c371677ac039ba20e5d12"}, {"url": "https://git.kernel.org/stable/c/ab3c4a4c85f2e1e8d04b5c1770dea8412d21c7fe"}, {"url": "https://git.kernel.org/stable/c/fe2a42789c12eb7c5d3a42191e2cc735a6c35ead"}, {"url": "https://git.kernel.org/stable/c/ab1404ac81154a89fb61ac50ae9a04cd8d4834dc"}], "title": "net: bridge: mdb: restart port group walk after deletion", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bridge/br_mdb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "46ec55855c972504258c371677ac039ba20e5d12", "status": "affected", "version": "a6acb535afb2a3b688a7858f05b61f0433e480d5", "versionType": "git"}, {"lessThan": "ab3c4a4c85f2e1e8d04b5c1770dea8412d21c7fe", "status": "affected", "version": "a6acb535afb2a3b688a7858f05b61f0433e480d5", "versionType": "git"}, {"lessThan": "fe2a42789c12eb7c5d3a42191e2cc735a6c35ead", "status": "affected", "version": "a6acb535afb2a3b688a7858f05b61f0433e480d5", "versionType": "git"}, {"lessThan": "ab1404ac81154a89fb61ac50ae9a04cd8d4834dc", "status": "affected", "version": "a6acb535afb2a3b688a7858f05b61f0433e480d5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bridge/br_mdb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mdb: restart port group walk after deletion\n\nbr_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking\nmp->ports. br_multicast_del_pg() can re-enter the same MDB entry through\nbr_multicast_sg_del_exclude_ports() and unlink other port groups. If the\ncursor points into one of those groups, the next iteration dereferences a\nstale cursor and can leave mp->ports pointing at freed memory.\n\nA following RTM_GETMDB exposes the dangling pointer:\n\n BUG: KASAN: slab-use-after-free in br_mdb_dump\n Read of size 8\n br_mdb_dump\n rtnl_mdb_dump\n rtnl_dumpit\n netlink_dump\n\nReset the cursor to mp->ports after every deletion. The deletion removes at\nleast the selected group, so the restarted walk always makes progress."}], "id": "CVE-2026-98487", "lastModified": "2026-10-19T10:19:00.277", "metrics": {}, "published": "2026-10-18T16:16:59.423", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/46ec55855c972504258c371677ac039ba20e5d12"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ab1404ac81154a89fb61ac50ae9a04cd8d4834dc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ab3c4a4c85f2e1e8d04b5c1770dea8412d21c7fe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fe2a42789c12eb7c5d3a42191e2cc735a6c35ead"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: bridge: mdb: restart port group walk after deletion", "id": "2554847", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554847"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: bridge: mdb: restart port group walk after deletion\nbr_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking\nmp->ports. br_multicast_del_pg() can re-enter the same MDB entry through\nbr_multicast_sg_del_exclude_ports() and unlink other port groups. If the\ncursor points into one of those groups, the next iteration dereferences a\nstale cursor and can leave mp->ports pointing at freed memory.\nA following RTM_GETMDB exposes the dangling pointer:\nBUG: KASAN: slab-use-after-free in br_mdb_dump\nRead of size 8\nbr_mdb_dump\nrtnl_mdb_dump\nrtnl_dumpit\nnetlink_dump\nReset the cursor to mp->ports after every deletion. The deletion removes at\nleast the selected group, so the restarted walk always makes progress.", "A flaw was found in the Linux kernel's network bridge subsystem. When deleting multicast database (MDB) port groups, the kernel can maintain a stale reference to memory that has already been freed during recursive group removal, resulting in a use-after-free condition. A local attacker could exploit this vulnerability through bridge management operations to trigger a system crash, leading to a Denial of Service (DoS), or potentially achieve privilege escalation."], "name": "CVE-2026-98487", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98487\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98487\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98487.mbox"], "threat_severity": "Moderate"}