The Linux kernel bridge multicast code updates the mdb_n_entries counter only under specific conditions. When a multicast group is added and a subsequent flush occurs while the bridge is not running or snooping is disabled, the counter decrease is executed without a matching prior increase, causing the counter to become inconsistent. This triggers kernel warnings such as "br_multicast_port_ngroups_dec_one", indicating an internal consistency error in the multicast database for that VLAN context. The vulnerability does not directly cause a denial of service or memory corruption as described; however, the inconsistent state could lead to unreliable multicast handling.

The vulnerability affects the Linux kernel. It is present in any kernel version that contains the br_multicast logic prior to the fix referenced in the advisory. Specific affected versions are not enumerated in the data provided, so any kernel incorporating the problematic logic should be reviewed.

The CVSS score is not provided, EPSS unavailable, and the vulnerability is not listed in KEV. Exploitation would require local privileged access to configure or manipulate bridge interfaces, implying that the threat is limited to privileged users or compromised systems. While no public exploit exists, the improper counter handling can lead to kernel warnings and potentially unreliable multicast behavior, which warrants patching.