What is the CVSS score of CVE-2026-74480?

CVE-2026-74480 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-74480?

A critical-severity Linux kernel bridge multicast vulnerability (CVE-2026-74480) could enable memory corruption and potential system compromise on affected infrastructure; however, exploitation…. A patch is available.

How to fix or mitigate CVE-2026-74480?

Within 24 hours, inventory Linux infrastructure to identify systems running bridge drivers with multicast-to-unicast functionality enabled or previously enabled. Within 7 days, deploy the vendor-released kernel patch to all affected systems, prioritizing production bridge/network infrastructure and any systems with untrusted network access. Within 30 days, verify patch deployment across affected systems and enable kernel memory corruption monitoring on bridged network nodes.

Linux Kernel CVE-2026-74480

EUVD-2026-59673 CRITICAL

2026-08-15 Linux

GHSA-98rv-7h6m-5q72

Information Disclosure Linux Red Hat Suse

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Trigger needs L2 adjacency (AV:A) and a non-default enable/disable race with multiple same-port groups (AC:H); no auth needed (PR:N); UAF in kernel can yield full C/I/A.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.3 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:43 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.8 (CRITICAL)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: stop fast-leave after deleting a port group

br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry.

If multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group with different source MAC addresses. Once multicast-to-unicast is disabled, br_port_group_equal() matches those entries by port only. A fast leave can then delete one entry and continue from its stale next pointer, leaving mp->ports pointing at a deleted port group.

Fast leave only needs to remove one matching port group. Break after br_multicast_del_pg() so the loop stops before dereferencing the removed entry.

AnalysisAI

Use-after-free in the Linux kernel bridge (net/bridge) multicast fast-leave path lets the group-leave handler dereference a freed port-group entry after br_multicast_del_pg() removes it, because the loop keeps walking through the stale next pointer. It affects bridges that had multicast-to-unicast enabled and later disabled while multiple per-source-MAC port groups existed, and can corrupt kernel memory. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the bridge to have had the multicast-to-unicast feature (per-port multicast_to_unicast) enabled and subsequently disabled while multiple port groups for the same port/group existed with differing source MAC addresses; only under that specific state does br_port_group_equal() match by port alone and let the fast-leave path free and then re-walk an entry. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8) is inconsistent with the described trigger: exploitation requires L2 adjacency to send group-leave (IGMP/MLD) traffic to the bridge and a specific state transition (multicast-to-unicast enabled then disabled with multiple same-port groups), which is closer to adjacent access and high complexity than remote/low-complexity - treat the 9.8 as an upper bound, not a realistic score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: update to a fixed stable kernel - 6.6.151, 6.12.103, 6.18.44, or 7.1.8 (or 7.2-rc6+) as appropriate for your branch - using your distribution's kernel package once it ships the corresponding backport; the fix simply breaks out of the leave loop after br_multicast_del_pg(). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory Linux infrastructure to identify systems running bridge drivers with multicast-to-unicast functionality enabled or previously enabled. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-74480 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74480

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code