DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-74480: CVE-2026-74480: Use-After-Free in Linux Kernel Network Bridge Multicast Routing

#security #cve #cybersecurity

CVE-2026-74480: Use-After-Free in Linux Kernel Network Bridge Multicast Routing

Vulnerability ID: CVE-2026-74480
CVSS Score: 9.8
Published: 2026-08-15

CVE-2026-74480 is a critical memory safety vulnerability in the Linux kernel's network bridge multicast routing subsystem (net: bridge) resulting from a Use-After-Free (UAF) condition during fast-leave processing of IGMP/MLD multicast groups.

TL;DR

A missing break statement in the Linux kernel's bridge multicast fast-leave handler leads to a Use-After-Free condition, allowing remote network-based Denial of Service or local privilege escalation.

Technical Details

  • CWE ID: CWE-416
  • Attack Vector: Network
  • CVSS v3.1: 9.8 (Critical)
  • EPSS Score: 0.00755
  • Impact: Denial of Service (DoS) / Remote Code Execution (RCE)
  • Exploit Status: None
  • KEV Status: Not Listed

Affected Systems

  • Linux Kernel 4.11 up to, but excluding, 7.2 (on configurations with bridge multicast snooping and multicast-to-unicast toggled)
  • Linux Kernel: >= 4.11, < 5.10.265 (Fixed in: 5.10.265)
  • Linux Kernel: >= 5.11, < 5.15.216 (Fixed in: 5.15.216)
  • Linux Kernel: >= 5.16, < 6.1.183 (Fixed in: 6.1.183)
  • Linux Kernel: >= 6.2, < 6.6.151 (Fixed in: 6.6.151)
  • Linux Kernel: >= 6.7, < 6.12.103 (Fixed in: 6.12.103)
  • Linux Kernel: >= 6.13, < 6.18.44 (Fixed in: 6.18.44)
  • Linux Kernel: >= 6.19, < 7.1.8 (Fixed in: 7.1.8)
  • Linux Kernel: >= 7.1.9, < 7.2 (Fixed in: 7.2)

Code Analysis

Commit: a39789f

net: bridge: fix use-after-free in br_multicast_leave_group

@@ -3687,6 +3687,7 @@ br_multicast_leave_group(struct net_bridge_mcast *brmctx,\n \n \t\t\tp->flags |= MDB_PG_FLAGS_FAST_LEAVE;\n \t\t\tbr_multicast_del_pg(mp, p, pp);\n+\t\t\tbreak;\n \t\t}\n \t\tgoto out;\n \t}
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Disable multicast snooping on active Layer 2 bridge interfaces to bypass fast-leave processing logic.
  • Filter untrusted IGMP and MLD Leave Group control packets at the network border using ebtables or nftables.
  • Avoid dynamically toggling the multicast-to-unicast option on active production bridge ports.

Remediation Steps:

  1. Identify vulnerable bridge configurations using 'ip -d link show type bridge'.
  2. Download and compile the latest security updates for the target Linux kernel version.
  3. Reboot the host system to apply the patched kernel.
  4. Verify that the active kernel version is equal to or greater than the fixed version targets.

References

Read the full report for CVE-2026-74480 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)