High [CVE-2026-74480] stop fast-leave after deleting a port group
This high-severity Red Hat Linux advisory covers CVE-2026-74480 affecting NVIDIA for RHEL 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry.
If multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group with different source MAC addresses. Once multicast-to-unicast is disabled, br_port_group_equal() matches those entries by port only.
A fast leave can then delete one entry and continue from its stale next pointer, leaving mp->ports pointing at a deleted port group. Fast leave only needs to remove one matching port group.
Break after br_multicast_del_pg() so the loop stops before dereferencing the removed entry. A flaw was found in the Linux kernel's network bridge module.
When handling multicast fast-leave, a vulnerability exists where the system may attempt to access a port group after it has been deleted. This can occur if multicast-to-unicast was previously enabled and then disabled, leading to a stale pointer.
This memory corruption vulnerability could lead to system instability or a denial of service.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 21 days ago·verify at source
- kernel-0:6.12.0-231.19.el10nv
- kernel-0:6.12.0-211.54.1.el10_2
- kernel-0:6.12.0-55.102.1.el10_0
- kernel-rt-0:3.10.0-1160.160.1.rt56.1312.el7
- kernel-0:3.10.0-1160.160.1.el7
- kernel-rt-0:4.18.0-553.160.1.rt7.501.el8_10
- kernel-0:4.18.0-553.160.1.el8_10
- kernel-0:4.18.0-305.204.1.el8_4
- kernel-0:4.18.0-372.211.1.el8_6
- kernel-0:4.18.0-477.164.1.el8_8
- kernel-0:5.14.0-687.46.1.el9_8
- kernel-0:5.14.0-284.190.1.el9_2
- kernel-rt-0:5.14.0-284.190.1.rt14.475.el9_2
- kernel-0:5.14.0-427.148.1.el9_4
- kernel-0:5.14.0-570.138.1.el9_6
- RHSA-2026:67277
- RHSA-2026:66355
- RHSA-2026:62609
- RHSA-2026:63539
- RHSA-2026:63538
- RHSA-2026:64770
- RHSA-2026:66000
- RHSA-2026:62372
- RHSA-2026:61973
- RHSA-2026:62345
- RHSA-2026:66180
- RHSA-2026:62508
- RHSA-2026:62522
- RHSA-2026:62346
- RHSA-2026:62568
Official advisory · high-confidence parse· fetched 21 days ago·verify at source
Mitigation checklist
- If bridge multicast snooping is not required, it can be disabled to prevent the vulnerable code path from being reached: ``` echo 0 > /sys/class/net/<bridge>/bridge/multicast_snooping ``` The br_multicast_leave_group() code path is only reachable when multicast snooping is active, so disabling it eliminates exposure to this flaw. Alternatively, avoid toggling multicast_to_unicast on bridge ports after it has been enabled. If multicast snooping is required, ensure that multicast_to_unicast is either left at its default (disabled) or, once enabled on a port, is not subsequently disabled while the port has active multicast group memberships.
Official advisory · high-confidence parse· fetched 21 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.