This CVE exposes a latent iteration bug in the Linux kernel bridge fast-leave path that becomes triggerable only through a specific configuration state transition. The vulnerability lives in the multicast group deletion logic where a missing break statement allows the loop to continue after it has already deleted the relevant entry.
The trigger sequence is critical: first, multicast-to-unicast conversion must be enabled on a bridge port, creating multiple port group entries with different source MACs for the same port/group combination. Then, multicast-to-unicast must be disabled. This changes how br_port_group_equal() evaluates membership—instead of comparing (port, group, source MAC), it compares only by port. The loop was written assuming it might encounter multiple independent entries needing deletion, but in the post-transition state, a single deletion satisfies the logical operation. The code correctly identifies the entry to delete, then incorrectly continues iterating, leading to undefined behavior.
The 9.8 CVSS rating contrasts sharply with an EPSS of 0.00457. This gap exists because exploitation requires a specific configuration sequence that likely needs privileged access to bridge settings. The 'modify memory' CVSS vector likely overstates the impact—this is more probably a crash/DoS than exploitable control-flow hijacking. Organizations should weight EPSS more heavily than CVSS for prioritization.
Practically, verify whether your bridge configurations ever enable and disable multicast-to-unicast conversion. If they do not, the actual risk is minimal. The kernel fix is a single line (the missing break), but the deeper lesson is that configuration-dependent iteration bugs are exceptionally difficult to catch in standard testing—steady-state testing passes, and code review sees correct-looking logic that fails only during state transitions.