{
  "threat_severity" : "Important",
  "public_date" : "2026-08-15T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: net: bridge: stop fast-leave after deleting a port group",
    "id" : "2517046",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2517046"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-825",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nnet: bridge: stop fast-leave after deleting a port group\nbr_multicast_leave_group() iterates mp->ports with pp = &p->next in\nits fast-leave path. After br_multicast_del_pg() removes p,\ncontinuing the loop advances pp through the deleted entry.\nIf multicast-to-unicast was enabled, the bridge can hold multiple port\ngroups for the same port and group with different source MAC\naddresses. Once multicast-to-unicast is disabled,\nbr_port_group_equal() matches those entries by port only. A fast leave\ncan then delete one entry and continue from its stale next pointer,\nleaving mp->ports pointing at a deleted port group.\nFast leave only needs to remove one matching port group. Break after\nbr_multicast_del_pg() so the loop stops before dereferencing the\nremoved entry.", "A flaw was found in the Linux kernel's network bridge module. When handling multicast fast-leave, a vulnerability exists where the system may attempt to access a port group after it has been deleted. This can occur if multicast-to-unicast was previously enabled and then disabled, leading to a stale pointer. This memory corruption vulnerability could lead to system instability or a denial of service." ],
  "statement" : "If the multicast-to-unicast feature has not been explicitly enabled on any bridge port (it is disabled by default), the vulnerable code path cannot be reached. Systems that do not use Linux bridge interfaces - for example, systems that are not acting as hypervisors, container hosts, or network gateways - are not affected by this flaw.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-09-02T00:00:00Z",
    "advisory" : "RHSA-2026:62609",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "kernel-0:6.12.0-55.102.1.el10_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
    "release_date" : "2026-09-04T00:00:00Z",
    "advisory" : "RHSA-2026:63539",
    "cpe" : "cpe:/a:redhat:rhel_extras_rt_els:7",
    "package" : "kernel-rt-0:3.10.0-1160.160.1.rt56.1312.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
    "release_date" : "2026-09-04T00:00:00Z",
    "advisory" : "RHSA-2026:63538",
    "cpe" : "cpe:/o:redhat:rhel_els:7",
    "package" : "kernel-0:3.10.0-1160.160.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-09-08T00:00:00Z",
    "advisory" : "RHSA-2026:64770",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.160.1.rt7.501.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2026-09-02T00:00:00Z",
    "advisory" : "RHSA-2026:62372",
    "cpe" : "cpe:/o:redhat:rhel_aus:8.4",
    "package" : "kernel-0:4.18.0-305.204.1.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
    "release_date" : "2026-09-02T00:00:00Z",
    "advisory" : "RHSA-2026:62372",
    "cpe" : "cpe:/o:redhat:rhel_eus_long_life:8.4",
    "package" : "kernel-0:4.18.0-305.204.1.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2026-09-01T00:00:00Z",
    "advisory" : "RHSA-2026:61973",
    "cpe" : "cpe:/o:redhat:rhel_aus:8.6",
    "package" : "kernel-0:4.18.0-372.211.1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
    "release_date" : "2026-09-01T00:00:00Z",
    "advisory" : "RHSA-2026:61973",
    "cpe" : "cpe:/o:redhat:rhel_eus_long_life:8.6",
    "package" : "kernel-0:4.18.0-372.211.1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2026-09-02T00:00:00Z",
    "advisory" : "RHSA-2026:62345",
    "cpe" : "cpe:/o:redhat:rhel_tus:8.8",
    "package" : "kernel-0:4.18.0-477.164.1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2026-09-02T00:00:00Z",
    "advisory" : "RHSA-2026:62345",
    "cpe" : "cpe:/o:redhat:rhel_e4s:8.8",
    "package" : "kernel-0:4.18.0-477.164.1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-09-02T00:00:00Z",
    "advisory" : "RHSA-2026:62508",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "kernel-0:5.14.0-284.190.1.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-09-02T00:00:00Z",
    "advisory" : "RHSA-2026:62522",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2::nfv",
    "package" : "kernel-rt-0:5.14.0-284.190.1.rt14.475.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
    "release_date" : "2026-09-02T00:00:00Z",
    "advisory" : "RHSA-2026:62346",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.4",
    "package" : "kernel-0:5.14.0-427.148.1.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-09-02T00:00:00Z",
    "advisory" : "RHSA-2026:62568",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "kernel-0:5.14.0-570.138.1.el9_6"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux for NVIDIA 26",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/a:redhat:enterprise_linux_nvidia:"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-74480\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74480\nhttps://lore.kernel.org/linux-cve-announce/2026081536-CVE-2026-74480-e620@gregkh/T" ],
  "csaw" : true,
  "name" : "CVE-2026-74480",
  "mitigation" : {
    "value" : "If bridge multicast snooping is not required, it can be disabled to prevent the vulnerable code path from being reached:\n```\necho 0 > /sys/class/net/<bridge>/bridge/multicast_snooping\n```\nThe br_multicast_leave_group() code path is only reachable when multicast snooping is active, so disabling it eliminates exposure to this flaw.\nAlternatively, avoid toggling multicast_to_unicast on bridge ports after it has been enabled. If multicast snooping is required, ensure that multicast_to_unicast is either left at its default (disabled) or, once enabled on a port, is not subsequently disabled while the port has active multicast group memberships.",
    "lang" : "en:us"
  }
}