CVE-2026-98487

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98487", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.352Z", "datePublished": "2026-10-18T15:16:04.746Z", "dateUpdated": "2026-10-24T14:09:03.998Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:09:03.998Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mdb: restart port group walk after deletion\n\nbr_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking\nmp->ports. br_multicast_del_pg() can re-enter the same MDB entry through\nbr_multicast_sg_del_exclude_ports() and unlink other port groups. If the\ncursor points into one of those groups, the next iteration dereferences a\nstale cursor and can leave mp->ports pointing at freed memory.\n\nA following RTM_GETMDB exposes the dangling pointer:\n\n BUG: KASAN: slab-use-after-free in br_mdb_dump\n Read of size 8\n br_mdb_dump\n rtnl_mdb_dump\n rtnl_dumpit\n netlink_dump\n\nReset the cursor to mp->ports after every deletion. The deletion removes at\nleast the selected group, so the restarted walk always makes progress."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - A local sendmsg() on NETLINK_ROUTE carrying RTM_DELMDB with NLM_F_BULK reaches the patched br_mdb_flush_pgs() through rtnl_mdb_del() and ndo_mdb_del_bulk; received bridge packets do not enter this bulk-delete path.\nAC:L - The attacker can add a *,G EXCLUDE membership and permanent static S,G groups so br_multicast_sg_add_exclude_ports() creates skipped kernel-protocol STAR_EXCL nodes; a proto-static bulk flush then deterministically invalidates pp without a race.\nPR:L - rtnetlink_rcv_msg() requires CAP_NET_ADMIN through netlink_net_capable(), but an unprivileged user can obtain that capability in a user-created network namespace and create the bridge, ports, and MDB state there.\nUI:N - The attacker performs the RTM_NEWMDB setup, NLM_F_BULK RTM_DELMDB trigger, and optional RTM_GETMDB traversal through their own netlink socket; no victim action is required.\nS:U - The dangling mp->ports pointer corrupts and exposes bridge objects within the host kernel's existing security authority; it does not cross a guest-host, hypervisor, or IOMMU boundary.\nC:H - The persistent slab UAF lets reclaimed contents control p->next and p->key.port; br_mdb_fill_info() follows these links and returns port, timer, flag, and source-list data through RTM_GETMDB, enabling kernel-memory disclosure.\nI:H - Reusing the dangling node in br_multicast_del_pg() reaches hlist_del_init_rcu() through reclaimed pg->mglist.pprev and updates rhashtable and GC links, providing attacker-influenced kernel writes and potential control-flow hijacking.\nA:H - After br_multicast_destroy_port_group() calls kfree_rcu(), br_mdb_dump() produces the confirmed slab-use-after-free; stale p->key.port or p->next dereferences in dump or br_multicast_flood can oops or panic the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bridge/br_mdb.c"], "versions": [{"version": "a6acb535afb2a3b688a7858f05b61f0433e480d5", "lessThan": "46ec55855c972504258c371677ac039ba20e5d12", "status": "affected", "versionType": "git"}, {"version": "a6acb535afb2a3b688a7858f05b61f0433e480d5", "lessThan": "ab3c4a4c85f2e1e8d04b5c1770dea8412d21c7fe", "status": "affected", "versionType": "git"}, {"version": "a6acb535afb2a3b688a7858f05b61f0433e480d5", "lessThan": "fe2a42789c12eb7c5d3a42191e2cc735a6c35ead", "status": "affected", "versionType": "git"}, {"version": "a6acb535afb2a3b688a7858f05b61f0433e480d5", "lessThan": "ab1404ac81154a89fb61ac50ae9a04cd8d4834dc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bridge/br_mdb.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/46ec55855c972504258c371677ac039ba20e5d12"}, {"url": "https://git.kernel.org/stable/c/ab3c4a4c85f2e1e8d04b5c1770dea8412d21c7fe"}, {"url": "https://git.kernel.org/stable/c/fe2a42789c12eb7c5d3a42191e2cc735a6c35ead"}, {"url": "https://git.kernel.org/stable/c/ab1404ac81154a89fb61ac50ae9a04cd8d4834dc"}], "title": "net: bridge: mdb: restart port group walk after deletion", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bridge/br_mdb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "46ec55855c972504258c371677ac039ba20e5d12", "status": "affected", "version": "a6acb535afb2a3b688a7858f05b61f0433e480d5", "versionType": "git"}, {"lessThan": "ab3c4a4c85f2e1e8d04b5c1770dea8412d21c7fe", "status": "affected", "version": "a6acb535afb2a3b688a7858f05b61f0433e480d5", "versionType": "git"}, {"lessThan": "fe2a42789c12eb7c5d3a42191e2cc735a6c35ead", "status": "affected", "version": "a6acb535afb2a3b688a7858f05b61f0433e480d5", "versionType": "git"}, {"lessThan": "ab1404ac81154a89fb61ac50ae9a04cd8d4834dc", "status": "affected", "version": "a6acb535afb2a3b688a7858f05b61f0433e480d5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bridge/br_mdb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mdb: restart port group walk after deletion\n\nbr_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking\nmp->ports. br_multicast_del_pg() can re-enter the same MDB entry through\nbr_multicast_sg_del_exclude_ports() and unlink other port groups. If the\ncursor points into one of those groups, the next iteration dereferences a\nstale cursor and can leave mp->ports pointing at freed memory.\n\nA following RTM_GETMDB exposes the dangling pointer:\n\n BUG: KASAN: slab-use-after-free in br_mdb_dump\n Read of size 8\n br_mdb_dump\n rtnl_mdb_dump\n rtnl_dumpit\n netlink_dump\n\nReset the cursor to mp->ports after every deletion. The deletion removes at\nleast the selected group, so the restarted walk always makes progress."}], "id": "CVE-2026-98487", "lastModified": "2026-10-24T14:16:43.960", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-18T16:16:59.423", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/46ec55855c972504258c371677ac039ba20e5d12"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ab1404ac81154a89fb61ac50ae9a04cd8d4834dc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ab3c4a4c85f2e1e8d04b5c1770dea8412d21c7fe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fe2a42789c12eb7c5d3a42191e2cc735a6c35ead"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: bridge: mdb: restart port group walk after deletion", "id": "2554847", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554847"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: bridge: mdb: restart port group walk after deletion\nbr_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking\nmp->ports. br_multicast_del_pg() can re-enter the same MDB entry through\nbr_multicast_sg_del_exclude_ports() and unlink other port groups. If the\ncursor points into one of those groups, the next iteration dereferences a\nstale cursor and can leave mp->ports pointing at freed memory.\nA following RTM_GETMDB exposes the dangling pointer:\nBUG: KASAN: slab-use-after-free in br_mdb_dump\nRead of size 8\nbr_mdb_dump\nrtnl_mdb_dump\nrtnl_dumpit\nnetlink_dump\nReset the cursor to mp->ports after every deletion. The deletion removes at\nleast the selected group, so the restarted walk always makes progress.", "A flaw was found in the Linux kernel's network bridge subsystem. When deleting multicast database (MDB) port groups, the kernel can maintain a stale reference to memory that has already been freed during recursive group removal, resulting in a use-after-free condition. A local attacker could exploit this vulnerability through bridge management operations to trigger a system crash, leading to a Denial of Service (DoS), or potentially achieve privilege escalation."], "name": "CVE-2026-98487", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98487\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98487\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98487.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a6acb535afb2a3b688a7858f05b61f0433e480d5,46ec55855c972504258c371677ac039ba20e5d12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a6acb535afb2a3b688a7858f05b61f0433e480d5,ab3c4a4c85f2e1e8d04b5c1770dea8412d21c7fe)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a6acb535afb2a3b688a7858f05b61f0433e480d5,fe2a42789c12eb7c5d3a42191e2cc735a6c35ead)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a6acb535afb2a3b688a7858f05b61f0433e480d5,ab1404ac81154a89fb61ac50ae9a04cd8d4834dc)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T23:45:07.050332+00:00", "updated": "2026-10-24T16:00:18.173006+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}