CVE-2026-98487

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mdb: restart port group walk after deletion

br mdb flush pgs() keeps a pointer-to-pointer cursor while walking mp->ports. br multicast del pg() can re-enter the same MDB entry through br multicast sg del exclude ports() and unlink other port groups. If the cursor points into one of those groups, the next iteration dereferences a stale cursor and can leave mp->ports pointing at freed memory.

A following RTM GETMDB exposes the dangling pointer:

BUG: KASAN: slab-use-after-free in br mdb dump Read of size 8 br mdb dump rtnl mdb dump rtnl dumpit netlink dump

Reset the cursor to mp->ports after every deletion. The deletion removes at least the selected group, so the restarted walk always makes progress.