Fedora Account System
Red Hat Associate
Red Hat Customer
In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry. If multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group with different source MAC addresses. Once multicast-to-unicast is disabled, br_port_group_equal() matches those entries by port only. A fast leave can then delete one entry and continue from its stale next pointer, leaving mp->ports pointing at a deleted port group. Fast leave only needs to remove one matching port group. Break after br_multicast_del_pg() so the loop stops before dereferencing the removed entry.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2026081536-CVE-2026-74480-e620@gregkh/T
FYI: A public exploit for CVE-2026-74480 has been released, including an exploit targeting RHEL 10.2. Red Hat CVE: https://access.redhat.com/security/cve/cve-2026-74480 Public exploit: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-74480-RHEL-10.2 Demo video: https://x.com/nebusecurity/status/2091786812981387550 The issue was introduced in Linux 4.11 by: 6db6f0eae6052b70885562e1733896647ec1d807 Relevant stable fixes: Linux 6.6.151: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=159ad90cb929c033308bb39a2c5f8fbf393b77aa Linux 6.12.103: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4695430e8132420bf8de94da3eb36a6cf35fde6b Could you please check whether the corresponding fix needs to be backported to the affected RHEL 8, RHEL 9, and RHEL 10 kernel branches? Since a working public exploit for RHEL 10.2 is now available, this may warrant prioritizing the backport.
FYI, a working public exploit targeting RHEL 10.2 is now available. Kconfig suggests the following may be a possible mitigation: echo 'install bridge /bin/false' > /etc/modprobe.d/disable-bridge.conf This has not been fully validated as a mitigation.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:61973 https://access.redhat.com/errata/RHSA-2026:61973
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:62346 https://access.redhat.com/errata/RHSA-2026:62346
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:62345 https://access.redhat.com/errata/RHSA-2026:62345
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:62372 https://access.redhat.com/errata/RHSA-2026:62372
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:62522 https://access.redhat.com/errata/RHSA-2026:62522
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:62508 https://access.redhat.com/errata/RHSA-2026:62508
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:62568 https://access.redhat.com/errata/RHSA-2026:62568
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:62609 https://access.redhat.com/errata/RHSA-2026:62609
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:63539 https://access.redhat.com/errata/RHSA-2026:63539
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:63538 https://access.redhat.com/errata/RHSA-2026:63538
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:64770 https://access.redhat.com/errata/RHSA-2026:64770
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:66000 https://access.redhat.com/errata/RHSA-2026:66000
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:66180 https://access.redhat.com/errata/RHSA-2026:66180
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:66355 https://access.redhat.com/errata/RHSA-2026:66355
This issue has been addressed in the following products: NVIDIA for RHEL 10 Via RHSA-2026:67277 https://access.redhat.com/errata/RHSA-2026:67277
This issue has been addressed in the following products: NVIDIA for RHEL 10 Via RHSA-2026:73187 https://access.redhat.com/errata/RHSA-2026:73187