In the Linux kernel, the following vulnerability has been resolved:

bridge: mcast: Fix a possible use-after-free when removing a bridge port

When per-VLAN multicast snooping is enabled, the bridge iterates over
all the bridge ports, disables the per-port multicast context on each
port and enables the per-{port, VLAN} multicast contexts instead. The
reverse happens when per-VLAN multicast snooping is disabled.

When global multicast snooping is enabled, the bridge iterates over all
the bridge ports and enables the per-port multicast context on each
port. The reverse happens when multicast snooping is disabled.

The above scheme can result in a situation where both types of contexts
(per-port and per-{port, VLAN}) are enabled on a single bridge port:

 # ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1
 # ip link add name dummy1 up master br1 type dummy
 # ip link set dev br1 type bridge mcast_vlan_snooping 1
 # ip link set dev br1 type bridge mcast_snooping 0
 # ip link set dev br1 type bridge mcast_snooping 1

This is not intended and it is a problem since the commit cited below.
Prior to this commit, when removing a bridge port,
br_multicast_disable_port() would disable the per-port multicast context
and the per-{port, VLAN} multicast contexts would get disabled when
flushing VLANs.

After this commit, br_multicast_disable_port() only disables the
per-port multicast context if per-VLAN multicast snooping is disabled.
If both types of contexts were enabled on the port when it was removed,
the per-port multicast context would remain enabled when freeing the
bridge port, leading to a use-after-free [1].

Fix by preventing the bridge from enabling / disabling the per-port
multicast contexts when toggling global multicast snooping if per-VLAN
multicast snooping is enabled.

[1]
ODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer_list hint: br_ip6_multicast_port_query_expired (net/bridge/br_multicast.c:1927)
WARNING: lib/debugobjects.c:629 at debug_print_object+0x1b1/0x3e0, CPU#5: swapper/5/0
[...]
Call Trace:
<IRQ>
__debug_check_no_obj_freed (lib/debugobjects.c:1116)
kfree (mm/slub.c:2620 mm/slub.c:6250 mm/slub.c:6565)
kobject_cleanup (lib/kobject.c:689)
rcu_do_batch (kernel/rcu/tree.c:2617)
rcu_core (kernel/rcu/tree.c:2869)
handle_softirqs (kernel/softirq.c:622)
__irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735)
irq_exit_rcu (kernel/softirq.c:752)
sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 47) arch/x86/kernel/apic/apic.c:1061 (discriminator 47))
</IRQ>

https://git.kernel.org/stable/c/1900ca8acb92fbea8bf9abef9927c7fed03db7fc

https://git.kernel.org/stable/c/4df78ff02629c7729168f0696a7a2123c389818d

https://git.kernel.org/stable/c/7213256c91ed778a0997c2029c152b18dc50e4fd

https://git.kernel.org/stable/c/a9224862d597d0eed0a34bbb27343f703fc4113f

https://git.kernel.org/stable/c/ddefd1b8e5eb58933a697ab38334f0fd82e7fb8b

https://git.kernel.org/stable/c/ebe5561154c823b323bd06e350b55e0b8604d851

https://git.kernel.org/stable/c/ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bridge/br_multicast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"410a033bfa8c7daefbae0225c836693db2149ec1","lessThan":"ddefd1b8e5eb58933a697ab38334f0fd82e7fb8b","versionType":"git","status":"affected"},{"version":"c6d16eab122744df698f18b47cf771945cd55066","lessThan":"ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70","versionType":"git","status":"affected"},{"version":"b4c83b37490d61cfdd62a2b29e98a9b89004b5c0","lessThan":"1900ca8acb92fbea8bf9abef9927c7fed03db7fc","versionType":"git","status":"affected"},{"version":"78f768e36c065ca3f88272fcf39014782c2d4ecd","lessThan":"ebe5561154c823b323bd06e350b55e0b8604d851","versionType":"git","status":"affected"},{"version":"4b30ae9adb047dd0a7982975ec3933c529537026","lessThan":"a9224862d597d0eed0a34bbb27343f703fc4113f","versionType":"git","status":"affected"},{"version":"4b30ae9adb047dd0a7982975ec3933c529537026","lessThan":"7213256c91ed778a0997c2029c152b18dc50e4fd","versionType":"git","status":"affected"},{"version":"4b30ae9adb047dd0a7982975ec3933c529537026","lessThan":"4df78ff02629c7729168f0696a7a2123c389818d","versionType":"git","status":"affected"},{"version":"c996e25df0b3282c724bb5aca434518bc08cd963","versionType":"git","status":"affected"},{"version":"5.15.186","lessThan":"5.15.209","versionType":"semver","status":"affected"},{"version":"6.1.142","lessThan":"6.1.175","versionType":"semver","status":"affected"},{"version":"6.6.95","lessThan":"6.6.142","versionType":"semver","status":"affected"},{"version":"6.12.35","lessThan":"6.12.92","versionType":"semver","status":"affected"},{"version":"6.15.4","lessThan":"6.16","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bridge/br_multicast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"5.15.209","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.175","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.142","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.92","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]