CVE-2026-98487 net: bridge: mdb: restart port group walk after deletion
A use-after-free in the Linux kernel bridge multicast code allows local attackers to cause a crash or read freed memory via netlink dumps.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98487?
CVE-2026-98487 is a high-severity use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: mdb: restart port group walk after deletion
br_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking mp->ports. br_multicast_del_pg() can re-enter the same MDB entry through br_multicast_sg_del_exclude_ports() and unlink other port groups. If the cursor points into one of those groups, the next iteration dereferences a stale cursor and can leave mp->ports pointing at freed memory.
A following RTM_GETMDB exposes the dangling pointer:
BUG: KASAN: slab-use-after-free in br_mdb_dump Read of size 8 br_mdb_dump rtnl_mdb_dump rtnl_dumpit netlink_dump
Reset the cursor to mp->ports after every deletion. The deletion removes at least the selected group, so the restarted walk always makes progress.
Which versions are affected by CVE-2026-98487?
How do I fix CVE-2026-98487?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98487 being exploited?
There is no known exploitation of CVE-2026-98487 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98487, DEBIAN-CVE-2026-98487, GHSA-vh4c-7r22-fq6w, UBUNTU-CVE-2026-98487.