The Linux kernel’s bridge multicast module updates an internal counter only under limited conditions. When a multicast group is added and later the group list is flushed while multicast snooping is disabled or the bridge is not running, the decrement operation occurs without a matching increment. This mismatch triggers kernel warnings such as "br_multicast_port_ngroups_dec_one" and indicates an inconsistent multicast database state. The vulnerability is limited to an internal consistency error and does not prove out‑of‑bounds memory writes or immediate denial of service, but it can lead to unreliable multicast handling on the affected bridge.

All Linux kernel releases that contain the buggy br_multicast code before the patch that unconditionally updates the counter are affected. The issue is present in any kernel that incorporates the original multicast handling logic and has not yet applied the commit that removes the conditional counter increment.

The CVSS score is 5.5, EPSS is below 1%, and the flaw is not catalogued in KEV. Exploitation would require local privileged access to manipulate bridge interfaces or a compromised system with such privileges, as the attack vector involves configuring bridge attributes. The primary risk is the emergence of kernel warnings and the potential for degraded multicast performance, which motivates timely remediation.