In the Linux kernel, the following vulnerability has been resolved:
net: bridge: stop fast-leave after deleting a port group
br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry.
If multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group with different source MAC addresses. Once multicast-to-unicast is disabled, br_port_group_equal() matches those entries by port only. A fast leave can then delete one entry and continue from its stale next pointer, leaving mp->ports pointing at a deleted port group.
Fast leave only needs to remove one matching port group. Break after br_multicast_del_pg() so the loop stops before dereferencing the removed entry.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.12-debuginfo-common-x86_64Upgrade perf6.12Upgrade kernel-livepatch-6.12.103-127.188Upgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-headersUpgrade kernel6.12Upgrade kernel6.12-modules-extraUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-toolsUpgrade bpftool6.12-debuginfoUpgrade kernel6.12-debuginfoUpgrade bpftool6.12Upgrade kernel6.12-tools-develUpgrade kernel6.12-develUpgrade python3-perf6.12Upgrade python3-perf6.12-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel6.12-tools-debuginfo | Sep 1, 2026 | Aug 15, 2026 |
| Debian | — | Upgrade linux | Aug 26, 2026 | Aug 26, 2026 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Aug 21, 2026 | Aug 15, 2026 |
| Rocky_linux | — | Upgrade perf-debuginfoUpgrade kernel-modules-coreUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-modules-coreUpgrade rvUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-develUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modules-extraUpgrade libperf-debuginfoUpgrade kernel-debug-devel-matchedUpgrade perfUpgrade kernel-toolsUpgrade libperfUpgrade kernel-rt-debug-develUpgrade kernel-debugUpgrade kernel-modules-extraUpgrade kernel-debug-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-develUpgrade kernel-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-coreUpgrade kernel-devel-matchedUpgrade python3-perfUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-debug-develUpgrade rtlaUpgrade kernel-coreUpgrade kernel-rt-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-debug-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-rt-develUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debugUpgrade kernel-debug-uki-virtUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-rt-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-rtUpgrade kernel-rt-debug-coreUpgrade kernel-modules-extra-matchedUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-tools-debuginfoUpgrade kernelUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debuginfo | Sep 10, 2026 | Sep 9, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 21, 2026 | Aug 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub