Critical Vulnerability in Linux Kernel Network Bridge

Affected Environment
Linux kernel versions 5.10 through 7.1 running the network bridge module, particularly where multicast-to-unicast was previously enabled on affected systems.

Threat Overview
A use-after-free in bridge multicast fast-leave handling lets a local attacker crash affected systems or escalate privileges to root.

Exposure Timeline
Disclosed 25 August 2026 and issued 26 August 2026, with patches already available across all seven affected kernel branches.

Attack Surface
Local access to systems where multicast-to-unicast was previously enabled then disabled, leaving stale port group pointers reachable during fast leave operations.

Technical Root Cause
br_multicast_leave_group continues iterating after br_multicast_del_pg deletes a matching port group entry, dereferencing a stale next pointer.

Exploitation Pathway
A local attacker triggers a fast leave event on a bridge that previously used multicast-to-unicast, corrupting memory to crash the system or gain root.