---
title: "CVE-2026-74480 — A multicast leave could leave a freed bridge group reachable"
description: "CVE-2026-74480: Linux bridge multicast could continue walking through a group after deleting it. Under a particular configuration change, the live group list could still point at an entry already scheduled to be freed. Fixed upstream in July 2026."
url: https://nebusec.ai/buglist/CVE-2026-74480/
published: 2026-08-23T00:00:00.000Z
---

CVE-2026-74480 · Critical

# A multicast leave could leave a freed bridge group reachable

Linux kernel · bridge multicast · Published Aug 23, 2026

br_multicast_del_pg

* [CVSS 9.8 · CNA ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-74480)
* Fixed
* Use-after-free
* Namespace required

Affects · RHEL 10.2 · Linux 6.12.0-211.7.3.el10_2 demo target · Bridge multicast-to-unicast transitions

[View exploit→](#exploit)

Artifacts · [exploit.md](#exploit) · [patch.diff](#patch)

## Summary

Linux bridge multicast could continue walking through a group after deleting it. Under a particular configuration change, the live group list could still point at an entry already scheduled to be freed.

The public exploit targeted Red Hat Enterprise Linux 10.2. The vulnerable logic dated to January 2017 and was fixed upstream in July 2026.

## Why it mattered

An unprivileged multicast listener inside a suitable network namespace could trigger the faulty leave sequence after an administrator changed the port mode. Later packet forwarding could touch the freed group, enabling kernel memory corruption and local privilege escalation.

The affected code has been fixed. The risk described here applies to unpatched kernels in the affected line, not automatically to every system using the named distribution today.

## What went wrong

The fast-leave loop advanced through `p->next` even after `br_multicast_del_pg()` removed `p`. When multicast-to-unicast was turned off, several groups could compare as equal, making subsequent deletions write through links owned by an already-removed group.

## Exploit

Because the issue and its fixes are public, NebuSec’s validation code is included here for reproducibility. The preview starts at the program entry point and shows exactly 15 lines. Expanding it reveals the complete selected C file embedded in this page; build files, headers, helpers, and any additional sources remain in the linked CyberMeowfia directory.

Public exploit · patched target

CyberMeowfia snapshot4c1f0aa

[Browse all files](https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-74480-RHEL-6.12.0-211.7.3.el10_2)

Exploit entry point · 952 lines · [Open at main() ↗](https://github.com/NebuSec/CyberMeowfia/blob/4c1f0aaaf1b981e74c47f24d88ebdf6ad51c9586/security-research/Linux-CVE-2026-74480-RHEL-6.12.0-211.7.3.el10_2/exploit.c#L936)

```c
int main(int argc, char **argv)
{
    setvbuf(stdout, NULL, _IONBF, 0);
    if (argc > 1 && !strcmp(argv[1], "--leak-only")) {
        resolve_addresses();
        return 0;
    }
    if (argc > 1 && !strcmp(argv[1], "--vuln-trigger"))
        return run_exploit(1);
    if (argc > 1 && !strcmp(argv[1], "--disable-selinux"))
        return run_exploit(0);
    if (argc > 1 && !strcmp(argv[1], "--core-stage"))
        return run_exploit(0);
    if (argc > 1)
        return root_helper(argv[1]);
```

The selected file is the execution entry point. Build files, headers, leak helpers, and supporting sources remain in the linked CyberMeowfia directory.

## Patch

**Fixed upstream in July 2026.** The corrected traversal no longer follows list links through an object after deletion. Install the RHEL kernel update carrying the upstream July 2026 fix; the demo’s exact build identifies the research target, not a claim about later RHEL kernels.

The safest check is the distribution’s own kernel changelog for `CVE-2026-74480`; version numbers alone can be misleading because vendors routinely backport security fixes without changing to the newest upstream kernel.

Find bugs in your code.

Before anyone else does.

[Book a demo](https://nebusec.ai/book-a-demo/)