The vulnerability occurs when the Linux kernel’s bridge multicast database traversal function, br_mdb_flush_pgs, retains a stale cursor after a port group is deleted, causing future iterations to dereference freed memory. The kernel’s KASAN diagnostics show a use‑after‑free in br_mdb_dump, which is triggered when an RTM_GETMDB netlink command reads the multicast database. This indicates that reading kernel memory via the netlink interface can expose a dangling pointer.

Affected systems include any Linux kernel with bridge support; the entry lists no specific version constraints, implying that all kernel releases prior to the fix are vulnerable.

Risk is high. The CVSS score of 7.8 indicates a high severity use‑after‑free that can lead to information disclosure or arbitrary code execution. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV. The likely attack vector is a privileged netlink request, as the RTM_GETMDB command can read the dangling pointer; this inference is based on the description. An attacker with CAP_NET_ADMIN privileges, local or network‑based depending on system configuration, could exploit the fault by issuing the RTM_GETMDB command after a port group deletion.