---
id: CVE-2026-98026
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: bridge: mcast: properly convert mglist to rcu

  Sashiko reported a bug [1] that br_multicast_del_port_group unlists the
  port group not using proper rcu helper that …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: bridge: mcast: properly convert mglist to rcu

  Sashiko reported a bug [1] that br_multicast_del_port_group unlists the
  port group not using proper rcu helper that …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 07f8ac4a1e26e8283542cdaf658a6e2a12fd6980 <
    37cb9a81600da8250f24e25edc07253b62353cbe
  - >-
    Linux >= 07f8ac4a1e26e8283542cdaf658a6e2a12fd6980 <
    98247c8264d2076f81fa114bdfa2c2271953ac7c
  - >-
    Linux >= 07f8ac4a1e26e8283542cdaf658a6e2a12fd6980 <
    38ab2a435001a3c4dbeb70a52f5921e1ccd66f55
  - >-
    Linux >= 07f8ac4a1e26e8283542cdaf658a6e2a12fd6980 <
    f7bf57e94a5d6214b87be08486cb33836fbfa573
  - >-
    Linux >= 07f8ac4a1e26e8283542cdaf658a6e2a12fd6980 <
    4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0
  - Linux 3.16
published: '2026-09-25'
updated: '2026-10-03'
sourceUpdated: '2026-10-03T11:18:25.677'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98026'
references:
  - url: 'https://git.kernel.org/stable/c/37cb9a81600da8250f24e25edc07253b62353cbe'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/38ab2a435001a3c4dbeb70a52f5921e1ccd66f55'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/98247c8264d2076f81fa114bdfa2c2271953ac7c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f7bf57e94a5d6214b87be08486cb33836fbfa573'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98026.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98026'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2541027'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98026'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98026'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98026.mbox
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00168
epssPercentile: 0.06032
cvssSource: vendor
ingestedAt: '2026-09-25T11:06:38.854Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mcast: properly convert mglist to rcu

Sashiko reported a bug [1] that br_multicast_del_port_group unlists the
port group not using proper rcu helper that preserves the next pointer and
after that immediately frees the port group without waiting for rcu grace
period. The only rcu walker of mglist is br_multicast_list_adjacent() and
it turns out that function has always been buggy because mglist was never
properly converted to RCU. Fix it by converting it to rcu and moving its
initialization after eth_addr's. Initializing p->next can use
RCU_INIT_POINTER because we have a barrier from the hlist_add_head_rcu call
later, besides we're initializing an unpublished structure anyway.

[1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260826014200.362304-1-littleddfu%40gmail.com

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98026.json)