https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 09 Nov 2026 18:43:35 +0000 https://db.gcve.eu/vuln/cve-2026-98487 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: bridge: mdb: restart port group walk after deletion</p> <p>br_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking mp-&gt;ports. br_multicast_del_pg() can re-enter the same MDB entry through br_multicast_sg_del_exclude_ports() and unlink other port groups. If the cursor points into one of those groups, the next iteration dereferences a stale cursor and can leave mp-&gt;ports pointing at freed memory.</p> <p>A following RTM_GETMDB exposes the dangling pointer:</p> <p>BUG: KASAN: slab-use-after-free in br_mdb_dump Read of size 8 br_mdb_dump rtnl_mdb_dump rtnl_dumpit netlink_dump</p> <p>Reset the cursor to mp-&gt;ports after every deletion. The deletion removes at least the selected group, so the restarted walk always makes progress.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: bridge: mdb: restart port group walk after deletion</p> <p>br_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking mp-&gt;ports. br_multicast_del_pg() can re-enter the same MDB entry through br_multicast_sg_del_exclude_ports() and unlink other port groups. If the cursor points into one of those groups, the next iteration dereferences a stale cursor and can leave mp-&gt;ports pointing at freed memory.</p> <p>A following RTM_GETMDB exposes the dangling pointer:</p> <p>BUG: KASAN: slab-use-after-free in br_mdb_dump Read of size 8 br_mdb_dump rtnl_mdb_dump rtnl_dumpit netlink_dump</p> <p>Reset the cursor to mp-&gt;ports after every deletion. The deletion removes at least the selected group, so the restarted walk always makes progress.</p> https://db.gcve.eu/vuln/cve-2026-98487