CVE-2026-98487

What it actually does

Use-after-free in Linux kernel bridge MDB code where br_mdb_flush_pgs maintains a stale pointer-to-pointer cursor into mp->ports; concurrent deletions via br_multicast_del_pg can unlink groups, leaving the cursor pointing to freed memory that is later dereferenced in br_mdb_dump during RTM_GETMDB netlink dumps.

Why it matters to the business

Kernel crashes or memory corruption on Linux systems using network bridges with multicast, resulting in denial of service and potential local privilege escalation or data leakage.

How an attack unfolds

An attacker with privileges to add or delete multicast port groups on a bridge interface triggers repeated deletions that invalidate the internal cursor, then issues an RTM_GETMDB netlink request to force the dump path to dereference the dangling pointer and trigger slab-use-after-free.

How to fix it

Apply the upstream fix that resets the cursor to mp->ports after every deletion inside br_mdb_flush_pgs; rebuild and deploy the patched kernel.

How to confirm the fix worked

Confirm the cursor-reset logic is present in br_mdb_flush_pgs; run synthetic MDB flush and dump workloads under KASAN to verify absence of use-after-free reports.

Typical attack path

1. Obtain capability to modify bridge multicast groups (e.g., CAP_NET_ADMIN)
2. Perform sequences of port-group additions and deletions that cause re-entrant unlinking
3. Issue RTM_GETMDB netlink dump to trigger br_mdb_dump on the corrupted list
4. Observe KASAN slab-use-after-free or kernel panic

How to detect it

Search kernel logs for KASAN slab-use-after-free reports naming br_mdb_dump or rtnl_mdb_dump; inspect netlink audit logs for RTM_GETMDB calls immediately following bridge MDB changes.

What your security team should do

• Prioritize kernel update on any system exposing bridge interfaces with multicast
• Enable KASAN or similar memory-safety instrumentation in test environments
• Restrict CAP_NET_ADMIN to trusted processes only