Fedora Account System
Red Hat Associate
Red Hat Customer
In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry. If multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group with different source MAC addresses. Once multicast-to-unicast is disabled, br_port_group_equal() matches those entries by port only. A fast leave can then delete one entry and continue from its stale next pointer, leaving mp->ports pointing at a deleted port group. Fast leave only needs to remove one matching port group. Break after br_multicast_del_pg() so the loop stops before dereferencing the removed entry.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2026081536-CVE-2026-74480-e620@gregkh/T
FYI: A public exploit for CVE-2026-74480 has been released, including an exploit targeting RHEL 10.2. Red Hat CVE: https://access.redhat.com/security/cve/cve-2026-74480 Public exploit: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-74480-RHEL-10.2 Demo video: https://x.com/nebusecurity/status/2091786812981387550 The issue was introduced in Linux 4.11 by: 6db6f0eae6052b70885562e1733896647ec1d807 Relevant stable fixes: Linux 6.6.151: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=159ad90cb929c033308bb39a2c5f8fbf393b77aa Linux 6.12.103: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4695430e8132420bf8de94da3eb36a6cf35fde6b Could you please check whether the corresponding fix needs to be backported to the affected RHEL 8, RHEL 9, and RHEL 10 kernel branches? Since a working public exploit for RHEL 10.2 is now available, this may warrant prioritizing the backport.
FYI, a working public exploit targeting RHEL 10.2 is now available. Kconfig suggests the following may be a possible mitigation: echo 'install bridge /bin/false' > /etc/modprobe.d/disable-bridge.conf This has not been fully validated as a mitigation.