bridge McastMglist UAF

Vulnerability analysis

A bridge multicast group object is removed from a linked list without the RCU-safe deletion helper and then freed immediately, before readers have finished walking the list. Meanwhile, another code path traverses that same list under RCU protection, so it can follow a dangling pointer to memory that has already been freed. The fix converts both insertion and deletion to RCU-safe operations: deletions now preserve the next pointer for in-flight readers, and the free is deferred until the grace period ends so the object stays valid for any ongoing walks. The pointer initialization is also reordered to happen before the new node is published to the list. The vulnerable surface is reachable by any local process that can create or manipulate a bridge interface with multicast snooping — including from within a user namespace where unprivileged users can gain the needed capability — but exploiting the bug requires winning a timing race between group removal and a concurrent list query.