The Linux kernel bridge multicast module maintains an internal counter of multicast groups in each VLAN context. Its increment operation is currently guarded by several conditions. When a bridge is taken down or multicast snooping is disabled and the group list is later flushed, the decrement path is executed without a corresponding increment, leaving the counter in an inconsistent state. This mismatch triggers kernel warnings such as "br_multicast_port_ngroups_dec_one". The bug does not cause out‑of‑bounds memory access, nor does it lead to immediate denial of service or privilege escalation. It only results in an inconsistent multicast database state and potential loss of multicast traffic handling, which may degrade network performance.

All Linux kernel releases that contain the original br_multicast implementation before the commit that removes the conditional counter increment are affected. The issue is present in any kernel where the buggy multicast handling logic is still in place and has not yet incorporated the fix that always updates the counter for VLAN contexts.

The CVSS score is 5.5 and the EPSS is below 1%, and the flaw is not catalogued in KEV. Based on the description, it is inferred that an attacker would need local privileged access to manipulate bridge interfaces or a system that already has such privileges. The primary risk is kernel warnings and possible unreliable multicast handling, which may affect availability of multicast services but does not directly enable code execution or data exfiltration.