In the Linux kernel, the following vulnerability has been resolved:
net: bridge: stop fast-leave after deleting a port group
br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry.
If multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group with different source MAC addresses. Once multicast-to-unicast is disabled, br_port_group_equal() matches those entries by port only. A fast leave can then delete one entry and continue from its stale next pointer, leaving mp->ports pointing at a deleted port group.
Fast leave only needs to remove one matching port group. Break after br_multicast_del_pg() so the loop stops before dereferencing the removed entry.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.12-debuginfoUpgrade kernel6.12-develUpgrade perf6.12-debuginfoUpgrade kernel6.12-tools-debuginfoUpgrade python3-perf6.12Upgrade bpftool6.12Upgrade kernel6.12-tools-develUpgrade kernel6.12-toolsUpgrade bpftool6.12-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade perf6.12Upgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-livepatch-6.12.103-127.188Upgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-modules-extraUpgrade kernel6.12Upgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-headers | Sep 1, 2026 | Aug 15, 2026 |
| Debian | — | Upgrade linux-6.12Upgrade linux | Aug 26, 2026 | Aug 26, 2026 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Aug 21, 2026 | Aug 15, 2026 |
| Rocky_linux | — | Upgrade libperf-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-toolsUpgrade kernel-modulesUpgrade libperfUpgrade kernel-debug-develUpgrade perfUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-uki-virt-addonsUpgrade rvUpgrade kernel-rt-debug-develUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-uki-virtUpgrade kernel-tools-libs-develUpgrade kernel-modules-coreUpgrade perf-debuginfoUpgrade python3-perfUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-develUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-rt-kvmUpgrade kernel-rtUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-s390xUpgrade kernel-tools-libsUpgrade kernel-rt-debugUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-debugUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-coreUpgrade rtlaUpgrade kernel-modules-extra-matchedUpgrade kernel-rt-debug-coreUpgrade kernelUpgrade kernel-rt-debuginfoUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-rt-develUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-modules-extraUpgrade python3-perf-debuginfo | Sep 10, 2026 | Sep 9, 2026 |
| Ubuntu | — | Upgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-6.8.0-1035-nvidia-tegraUpgrade linux-image-nvidia-tegraNo solution existsUpgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-6.8.0-1035-nvidia-tegra-rt | Sep 21, 2026 | Sep 18, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 21, 2026 | Aug 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub