CVE-2026-98026

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mcast: properly convert mglist to rcu

Sashiko reported a bug [1] that br_multicast_del_port_group unlists the

port group not using proper rcu helper that preserves the next pointer and

after that immediately frees the port group without waiting for rcu grace

period. The only rcu walker of mglist is br_multicast_list_adjacent() and

it turns out that function has always been buggy because mglist was never

properly converted to RCU. Fix it by converting it to rcu and moving its

initialization after eth_addr's. Initializing p->next can use

RCU_INIT_POINTER because we have a barrier from the hlist_add_head_rcu call

later, besides we're initializing an unpublished structure anyway.

[1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260826014200.362304-1-littleddfu%40gmail.com

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References