CVE-2026-99117

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mcast: don't truncate the port group walk on teardown

br multicast disable port ctx() and br multicast del port() walk port->mglist with hlist for each entry safe(). However, br multicast find del pg() can also delete other entries from the same list through br multicast fwd src remove() or fwd del star excl().

If such an entry is the iterator's saved next node, hlist del init() clears its ->next and terminates the walk early. The reproducer triggers this in both teardown walks, leaving port groups in the bridge mdb with a dangling ->key.port after del nbp() frees the port:

BUG: KASAN: slab-use-after-free in mdb fill info+0x1191/0x1320 mdb fill info+0x1191/0x1320 br mdb dump+0x594/0xe40 rtnl mdb dump+0x1cf/0x5d0

Use hlist del init rcu() to unlink the group while preserving ->next. br multicast del pg() and the teardown walks run under br->multicast lock. The GC worker must acquire the same lock before detaching the group for destruction, so the node remains alive while the walk uses the preserved pointer.

Preserving ->next means a walk can now reach a group that an earlier iteration already deleted as a side effect. That group is off mp->ports, so br multicast find del pg() would fall through its port scan and hit the trailing WARN ON(1). Skip such groups at the top of that helper: a port group is put on port->mglist when it is created and only unlinked when it is deleted, so hlist unhashed() identifies exactly this case.