The Linux kernel bridge subsystem has a use‑after‑free condition in br_multicast_leave_group. When a port group is removed, the function continues iterating over a stale pointer that references freed memory. This can corrupt kernel data structures and potentially trigger a kernel panic, causing availability loss. The flaw is a memory corruption weakness (CWE-825) and does not provide a direct code‑execution path.

All Linux kernel builds that include the bridge code before the commit that fixes the issue are affected. Because no specific distribution or packaging boundaries are listed and the CVE does not include version numbers, it is not possible to narrow the scope to particular kernel versions. Any Linux distribution running a vulnerable kernel that contains the unpatched bridge implementation is potentially exposed, so a comprehensive update of all affected hosts is advised. It should be explicitly noted that no version information is provided in the CVE.

The CVSS score is 9.8, indicating severe severity. The EPSS score is <1%, showing a low probability of exploitation of this vulnerability in the wild. The vulnerability is not listed in the CISA KEV catalog. The use‑after‑free requires local or privileged access to manipulate bridge port groups; the likely attack vector is execution of privileged bridge configuration commands such as brctl or bridge, which can trigger the deletion of a port group and the subsequent fast‑leave code path. Based on the description, it is inferred that an attacker would need administrative privileges on the host or privileged access to the bridge interface stack to execute the exploit.