Public PoC Released for Linux Kernel Bridge Use-After-Free Vulnerability

A public proof-of-concept (PoC) has been released for a use-after-free flaw affecting the Linux kernel’s bridge subsystem, specifically its Spanning Tree Protocol (STP) implementation. The vulnerability, found in net/bridge, arises when STP timers remain active after a bridge network device has been deleted, creating a memory-safety condition within the kmalloc-cg-8k slab cache.

The use-after-free condition is triggered when kernel STP is enabled on an administratively down bridge, and a bridge port subsequently transitions to the LEARNING state. In this scenario, the kernel can arm periodic STP timers without verifying the IFF_UP interface flag. These timers are crucial for the STP state machine, which prevents network loops by managing bridge-port states and topology changes. The timers, including hello_timer, tcn_timer, topology_change_timer, and port-specific timers, are stored within the struct net_bridge, which resides in the private data area of the bridge’s net_device. Consequently, these timers must be properly removed before the underlying network device memory is freed.

If these timers are left queued after the memory associated with the net_bridge structure is deallocated, the kernel might attempt to execute a timer callback using a stale memory reference. Researchers from SSD Disclosure identified that the bug stems from differing cleanup behaviors between a normal interface shutdown and a direct bridge deletion. During a standard UP-to-DOWN transition, the ndo_stop path correctly invokes br_stp_disable_bridge(), which synchronously cancels STP timers using del_timer_sync(). This ensures that pending callbacks do not access freed bridge data.

However, when a bridge is deleted via the delink path, the br_dev_delete() function is called, and this path does not trigger the same STP cleanup routine. If the interface is already down, the device-unregistration process might skip ndo_stop altogether. This leaves armed timers attached to a per-CPU timer base even after the associated net_device has been freed. When the kernel’s timer processing routine later handles these dangling timers in a softirq context, it can lead to dereferencing freed memory.

Security researchers noted that by carefully controlling the reallocation of the freed slab object, an attacker could potentially exploit this vulnerability to achieve control-flow hijacking. This elevates the potential impact beyond a simple denial-of-service or system crash, making it a more severe threat.

The public PoC demonstrates the affected lifecycle of the vulnerability and highlights the critical need for prompt remediation, especially in environments where bridge configuration changes are permitted by less trusted users. A patch for this Linux kernel vulnerability has been introduced in commit 2a00517db8de4be7df3d483b215c5544fb30a191.

Systems running Linux kernels prior to the application of this patch should be considered vulnerable. Administrators are strongly advised to update their kernels to the patched versions provided by their distribution. Until such updates can be deployed, it is recommended to restrict the ability of untrusted users to create, modify, or remove bridge interfaces and to carefully review any workloads that utilize kernel STP.