{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net: bridge: mcast: don't truncate the port group walk on teardown  __br_multicast_disable_port_ctx() and br_multicast_del_port() walk port-\u003emglist with hlist_for_each_entry_safe(). However, br_multicast_find_del_pg() can also delete other entries from the same list through br_multicast_fwd_src_remove() or __fwd_del_star_excl().  If such an entry is the iterator's saved next node, hlist_del_init() clears its -\u003enext and terminates the walk early. The reproducer triggers this in both teardown walks, leaving port groups in the bridge mdb with a dangling -\u003ekey.port after del_nbp() frees the port:    BUG: KASAN: slab-use-after-free in __mdb_fill_info+0x1191/0x1320    __mdb_fill_info+0x1191/0x1320    br_mdb_dump+0x594/0xe40    rtnl_mdb_dump+0x1cf/0x5d0  Use hlist_del_init_rcu() to unlink the group while preserving -\u003enext. br_multicast_del_pg() and the teardown walks run under br-\u003emulticast_lock. The GC worker must acquire the same lock before detaching the group for destruction, so the node remains alive while the walk uses the preserved pointer.  Preserving -\u003enext means a walk can now reach a group that an earlier iteration already deleted as a side effect. That group is off mp-\u003eports, so br_multicast_find_del_pg() would fall through its port scan and hit the trailing WARN_ON(1). Skip such groups at the top of that helper: a port group is put on port-\u003emglist when it is created and only unlinked when it is deleted, so hlist_unhashed() identifies exactly this case.",
  "id": "DEBIAN-CVE-2026-99117",
  "modified": "2026-10-29T05:47:41.070206782Z",
  "published": "2026-10-28T11:17:31.253Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-99117"
    }
  ],
  "upstream": [
    "CVE-2026-99117"
  ]
}