CVE-2026-74480

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: stop fast-leave after deleting a port group

brmulticastleave_group() iterates mp->ports with pp = &p->next in

its fast-leave path. After brmulticastdel_pg() removes p,

continuing the loop advances pp through the deleted entry.

If multicast-to-unicast was enabled, the bridge can hold multiple port

groups for the same port and group with different source MAC

addresses. Once multicast-to-unicast is disabled,

brportgroup_equal() matches those entries by port only. A fast leave

can then delete one entry and continue from its stale next pointer,

leaving mp->ports pointing at a deleted port group.

Fast leave only needs to remove one matching port group. Break after

brmulticastdel_pg() so the loop stops before dereferencing the

removed entry.