CVE-2026-74480: Use-After-Free in Linux Kernel Network Bridge Multicast Routing

The vulnerability CVE-2026-74480 affects the Linux kernel network bridge multicast routing subsystem, specifically within the br_multicast_leave_group function in net/bridge/br_multicast.c. This subsystem handles Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) snooping, allowing Layer 2 bridges to selectively forward multicast traffic to active subscribers. The defect is classified under CWE-416 (Use-After-Free).

The vulnerability is triggered during fast-leave processing of multicast groups on a bridge port that initially has multicast-to-unicast capabilities enabled and subsequently disabled. This logical sequence of configuration changes creates duplicate or overlapping port group entries in the bridge's multicast database. The attack surface is exposed to any network interface bridged by a vulnerable Linux host.

Successful exploitation can corrupt the internal database structures, resulting in an immediate local or remote Denial of Service (DoS) via kernel panic. In containerized or virtualized environments sharing the host network stack, the memory corruption could be leveraged to execute arbitrary code within the kernel context or achieve container escape.

The root cause of CVE-2026-74480 stems from an incomplete loop exit strategy during the deletion of a multicast port group. When multicast-to-unicast is active, the bridge tracks multiple net_bridge_port_group configurations for identical physical ports using distinct source MAC addresses. When this capability is subsequently disabled, the flag BR_MULTICAST_TO_UNICAST_BIT is cleared, changing the output of the equality matching function br_port_group_equal().

Once the bit is cleared, br_port_group_equal() returns true based solely on the match of the bridge port pointer, ignoring unique source MAC addresses. Consequently, the multicast database accumulates multiple distinct entries pointing to the same logical port. These entries are treated as identical under the newly modified evaluation logic, which populates the mp->ports list with duplicate matches.

When a fast-leave request is triggered, br_multicast_leave_group() iterates through the mp->ports list using a double-pointer iterator pp initialized to the address of mp->ports. The loop locates the matching port group, marks it with the MDB_PG_FLAGS_FAST_LEAVE flag, and deletes it using br_multicast_del_pg(). Because the loop lacks a break statement following the deletion call, the iterator continues execution, advancing to the increment statement pp = &p->next and dereferencing the next pointer of the recently freed p structure.

The vulnerable code path is located in net/bridge/br_multicast.c. Analysis of the loop structure demonstrates how the iterator pp becomes a dangling pointer after the deletion operation.

// Vulnerable loop representation in net/bridge/br_multicast.c
for (pp = &mp->ports;
     (p = mlock_dereference(*pp, brmctx->br)) != NULL;
     pp = &p->next) {
	if (br_port_group_equal(p, port, src)) {
		p->flags |= MDB_PG_FLAGS_FAST_LEAVE;
		br_multicast_del_pg(mp, p, pp); // Deletes and immediately queues 'p' to be freed
		// Missing break statement allows the loop to proceed
	}
	goto out;
}

The function br_multicast_del_pg() unlinks p from the list and schedules it for deallocation via the garbage collector. Because there is no termination logic, the loop returns to the third statement in the for loop declaration: pp = &p->next. At this execution point, p is a freed block of memory, resulting in an immediate invalid read when attempting to access p->next.

The official fix implements a single break; statement directly following the deletion function call. This ensures that the loop terminates immediately after unlinking the target, avoiding the evaluation of the increment expression.

// Patched loop representation in net/bridge/br_multicast.c
for (pp = &mp->ports;
     (p = mlock_dereference(*pp, brmctx->br)) != NULL;
     pp = &p->next) {
	if (br_port_group_equal(p, port, src)) {
		p->flags |= MDB_PG_FLAGS_FAST_LEAVE;
		br_multicast_del_pg(mp, p, pp);
		break; // Added by fix commit to terminate traversal
	}
	goto out;
}

Exploiting this defect requires a multi-stage configuration sequence on the target bridge interface. First, the target system must have bridge multicast snooping enabled and the multicast-to-unicast feature toggled from enabled to disabled on a bridge port. This populates the database with multiple distinct entries that match the same physical port configuration.

Second, the attacker transmits a specially crafted IGMP (for IPv4) or MLD (for IPv6) Leave Group network packet over the bridged segment. Upon receipt, the network stack forwards the packet to br_multicast_leave_group() to handle the fast-leave request. The execution flow enters the vulnerable loop and processes the match.

When the loop traverses the duplicate entries, the first match triggers br_multicast_del_pg(), which frees the memory backing p. The loop then attempts to read p->next from the freed memory area. In standard environments, this results in a page fault and kernel panic. In advanced exploitation scenarios, local attackers may use slab allocation spraying techniques to overwrite the deallocated memory block prior to the dereference, redirecting kernel execution flow.

The security impact of CVE-2026-74480 is critical, as reflected by its CVSS score of 9.8. The vulnerability is accessible over the network without authentication, requiring no user interaction. It presents a low attack complexity because standard network control packets are sufficient to trigger the code path.

The most immediate risk is a complete loss of availability. A crash of the Layer 2 bridging driver causes the entire operating system to panic, shutting down network gateways, bare-metal servers, or virtualized hosts. In multi-tenant cloud environments, a crash of the hypervisor's bridging driver results in a Denial of Service for all hosted virtual machines and containers.

If the memory space can be reliably controlled and manipulated prior to the dereference, privilege escalation or escape from containerized namespaces is theoretically possible. No public exploit payloads or active campaigns have been reported in the wild, and the current exploit maturity is classified as none.

The permanent resolution for CVE-2026-74480 is updating the host operating system's kernel to a version containing the official patch. Long-Term Support (LTS) kernel branches have been patched upstream. Systems must be updated to version 5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2 or newer.

For systems where immediate kernel updates and reboots are not possible, administrators can apply workarounds to reduce exposure. Disabling multicast snooping on active bridge interfaces completely bypasses the vulnerable execution path. This can be configured dynamically using the following command:

ip link set dev <bridge_name> type bridge mcast_snooping 0

Additionally, administrators can use packet filtering tools such as ebtables or nftables to block incoming IGMP or MLD Leave Group query packets from untrusted sources. To prevent the initial configuration prerequisite, avoid dynamically toggling the multicast-to-unicast configuration on active bridge ports.