CVE-2025-40297

Root

Cause

The vulnerability is a use-after-free in the Linux kernel's bridge implementation. When Multiple Spanning Tree (MST) is enabled, the bridge's port state check can be bypassed, allowing FDB learning to continue even after a port has been administratively disabled and its FDB entries flushed. This race condition exists because MST does not properly check the port's state before allowing learning, and when VLAN filtering is disabled, the VLAN group is destroyed during port deletion, which stops learning—but learning can still happen if MST bypasses the state check.

Attack

Vector

An attacker on the local network can trigger this by causing FDB learning to occur on a bridge port that is being deleted. The attack requires that MST is enabled and VLAN filtering is disabled. The port deletion process flushes VLANs and clears the VLAN group pointer, but if MST bypasses the disabled state, a concurrent learning operation can occur after the VLAN group has been freed, leading to a use-after-free on the FDB entry.

Impact

Successful exploitation results in a use-after-free, which can lead to memory corruption, system crash (denial of service), or potentially arbitrary code execution in kernel context, depending on how the freed memory is reused.

Mitigation

The fix adds a check for the port's VLAN group pointer, which is set to NULL during port deletion. This prevents MST from bypassing the disabled state. Patches are available in the stable kernel updates; users should apply the latest updates to their Linux kernel. This issue was reported via syzkaller [1].