The vulnerability involves the Linux kernel’s networking bridge module. The function br_multicast_del_port_group unlists a port group without using the correct RCU helper, then frees the structure immediately without waiting for the RCU grace period. Because the multicast list (mglist) was never properly converted to RCU, the adjacent walker br_multicast_list_adjacent() also remains buggy. This misuse of RCU can lead to a use‑after‑free or memory corruption condition inside the kernel. An attacker who can trigger multicast group deletion—typically by sending crafted multicast packets or manipulating bridge configurations—might exploit the resulting kernel instability to crash the system, steal data, or gain elevated privileges. The explicit impact is a potential denial of service or elevation of privilege due to corrupt kernel memory.

Linux kernel – all versions prior to the patch that added RCU conversion for mglist. The issue is present in the core networking bridge code and applies to all distributions that ship with the affected kernel configuration.

The EPSS score of < 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. The CVSS score of 5.5 indicates medium severity, and given the kernel-level nature of the flaw, it could still lead to privilege escalation or denial of service. The likely attack vector is network traffic that forces a multicast group deletion, requiring access to the host’s bridge interfaces or the ability to craft multicast packets.