In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion br_mdb_flush_pgs()… (CVE-2026-98487)

The vulnerability in the Linux kernel's net: bridge: mdb subsystem involves the br_mdb_flush_pgs() function maintaining a pointer-to-pointer cursor while iterating over mp->ports. The br_multicast_del_pg() function can re-enter the same MDB entry and unlink other port groups during deletion. If the cursor points to one of these deleted groups, subsequent iterations dereference a stale pointer, causing use-after-free. An RTM_GETMDB netlink request can expose this dangling pointer, leading to a KASAN slab-use-after-free error. The fix resets the cursor to mp->ports after each deletion to ensure the walk progresses safely without referencing freed memory.

The vulnerability causes a kernel use-after-free condition, which can lead to kernel crashes or instability when the affected code path is exercised. This impacts the network bridge multicast database handling and can be triggered by specific netlink requests. There is no indication of remote code execution or privilege escalation from the provided data.

A fix has been implemented that resets the cursor after each deletion to prevent stale pointer dereferences. Since the vulnerability is resolved in the Linux kernel, users should apply the official kernel updates containing this fix. No additional mitigation steps are indicated.