{"uuid": "b9dffe80-9892-4e71-afdc-9d9043c8d83a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74480", "type": "seen", "source": "https://gist.github.com/alon710/d147a2ae60e0ed5ec24cb1879123487a", "content": "# CVE-2026-74480: CVE-2026-74480: Use-After-Free in Linux Kernel Network Bridge Multicast Routing\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-08-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-74480\n\n## Summary\nCVE-2026-74480 is a critical memory safety vulnerability in the Linux kernel's network bridge multicast routing subsystem (net: bridge) resulting from a Use-After-Free (UAF) condition during fast-leave processing of IGMP/MLD multicast groups.\n\n## TL;DR\nA missing break statement in the Linux kernel's bridge multicast fast-leave handler leads to a Use-After-Free condition, allowing remote network-based Denial of Service or local privilege escalation.\n\n## Technical Details\n\n- **CWE ID**: CWE-416\n- **Attack Vector**: Network\n- **CVSS v3.1**: 9.8 (Critical)\n- **EPSS Score**: 0.00755\n- **Impact**: Denial of Service (DoS) / Remote Code Execution (RCE)\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Linux Kernel 4.11 up to, but excluding, 7.2 (on configurations with bridge multicast snooping and multicast-to-unicast toggled)\n- **Linux Kernel**: >= 4.11, < 5.10.265 (Fixed in: `5.10.265`)\n- **Linux Kernel**: >= 5.11, < 5.15.216 (Fixed in: `5.15.216`)\n- **Linux Kernel**: >= 5.16, < 6.1.183 (Fixed in: `6.1.183`)\n- **Linux Kernel**: >= 6.2, < 6.6.151 (Fixed in: `6.6.151`)\n- **Linux Kernel**: >= 6.7, < 6.12.103 (Fixed in: `6.12.103`)\n- **Linux Kernel**: >= 6.13, < 6.18.44 (Fixed in: `6.18.44`)\n- **Linux Kernel**: >= 6.19, < 7.1.8 (Fixed in: `7.1.8`)\n- **Linux Kernel**: >= 7.1.9, < 7.2 (Fixed in: `7.2`)\n\n## Mitigation\n\n- Disable multicast snooping on active Layer 2 bridge interfaces to bypass fast-leave processing logic.\n- Filter untrusted IGMP and MLD Leave Group control packets at the network border using ebtables or nftables.\n- Avoid dynamically toggling the multicast-to-unicast option on active production bridge ports.\n\n**Remediation Steps:**\n1. Identify vulnerable bridge configurations using 'ip -d link show type bridge'.\n2. Download and compile the latest security updates for the target Linux kernel version.\n3. Reboot the host system to apply the patched kernel.\n4. Verify that the active kernel version is equal to or greater than the fixed version targets.\n\n## References\n\n- [NVD CVE-2026-74480 Record](https://nvd.nist.gov/vuln/detail/CVE-2026-74480)\n- [CVE.org CVE-2026-74480 Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-74480)\n- [Patch Announcement & LKML Discussion](https://patch.msgid.link/1cf0898872ef7c72d5f4c0304414a192c6dac591.1784707712.git.zhilinz@nebusec.ai)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-74480) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T10:00:32.000000Z"}