Linux Kernel CVE-2026-98487

Requires LOCAL access with CAP_NET_ADMIN (grantable inside an unprivileged user namespace) to administer a Linux bridge that has multicast (MDB) snooping active. The specific trigger per the evidence is that an MDB entry must contain EXCLUDE-mode (S,G) port groups so that deleting a group re-enters the same entry via br_multicast_sg_del_exclude_ports() and unlinks other groups while br_mdb_flush_pgs() walks mp->ports; the attacker must flush/delete port groups and then issue an RTM_GETMDB dump to dereference the resulting dangling cursor. Limiting factors: not remotely reachable (AV:L), requires the CAP_NET_ADMIN privilege, requires a bridge with multicast snooping and the particular exclude-mode port-group layout, and affects kernels from ~6.8 up to the listed fixed versions - default systems without a configured multicast bridge are not exposed.

Signals point consistently toward a moderate, not urgent, priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms this is a LOCAL vulnerability requiring privileges (PR:L) - it is not remotely reachable, which the 7.8 base score alone can obscure. EPSS reinforces low real-world exploitation likelihood at 0.20% (9th percentile), there is no CISA KEV listing (not actively exploited), and no public exploit or PoC reference is provided in the input. The vuln.today decision label is 'this_week' and a vendor patch is available, so the appropriate action is to roll the fix in during normal stable-kernel update cadence rather than treat it as an emergency. Note a tension between signals: the input tags this 'Information Disclosure' and the only demonstrated impact in the evidence is a KASAN slab-use-after-free READ exposed via RTM_GETMDB (an info leak), yet the supplied CVSS claims C:H/I:H/A:H - the high integrity/availability impact is plausible for a kernel use-after-free that leaves mp->ports dangling at freed memory, but it is not demonstrated in the available evidence, which shows only a read. Overall: a real but privilege-gated local kernel bug in a specific bridge-multicast code path, not a widespread-exploitation emergency.

A local actor holding CAP_NET_ADMIN (including within a user namespace) over a Linux bridge configured for multicast snooping deletes/flushes port groups, causing br_multicast_del_pg() to re-enter the same MDB entry and unlink other groups while br_mdb_flush_pgs() still holds a stale pointer-to-pointer cursor, leaving mp->ports pointing at freed memory. A subsequent RTM_GETMDB netlink dump then dereferences the dangling pointer and reads freed kernel slab memory. No public exploit or PoC reference is identified in the input.