CVE-2026-74480
CVE-2026-74480: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh7.8
High [CVE-2026-74480] stop fast-leave after deleting a port group
CVE-2026-74480Source published Source updated
In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry. If multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group with different source MAC addresses. Once multicast-to-unicast is disabled, br_port_group_equal() matches those entries by port only. A fast leave can then delete one entry and continue from its stale next pointer, leaving mp->ports pointing at a deleted port group. Fast leave only needs to remove one matching port group. Break after br_multicast_del_pg() so the loop stops…
- Affected products in this advisory
- NVIDIA for RHEL 10
- Red Hat Enterprise Linux 10.0 Extended Update Support
- Red Hat Enterprise Linux 7 Extended Lifecycle Support
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
9 more entries in the full advisory.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- kernel-0:6.12.0-231.19.el10nv
- kernel-0:6.12.0-211.54.1.el10_2
- kernel-0:6.12.0-55.102.1.el10_0
- kernel-rt-0:3.10.0-1160.160.1.rt56.1312.el7
26 more entries in the full advisory.
- Mitigation guidance
- If bridge multicast snooping is not required, it can be disabled to prevent the vulnerable code path from being reached: ``` echo 0 > /sys/class/net/<bridge>/bridge/multicast_snooping ``` The br_multicast_leave_group() code path is only reachable when multicast snooping is active, so disabling it eliminates exposure to this flaw. Alternatively, avoid toggling multicast_to_unicast on bridge ports after it has been enabled. If multicast snooping is required, ensure that multicast_to_unicast is either left at its default (disabled) or, once enabled on a port, is not subsequently disabled while the port has active multicast group memberships.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.