Linux Kernel Vulnerability Exposes Systems to Control-Flow Hijacking via STP Timer Flaw
A proof-of-concept (PoC) exploit has been released for a use-after-free vulnerability in the Linux kernel’s software bridge implementation (net/bridge), specifically within the Spanning Tree Protocol (STP) timer lifecycle. The flaw, identified by researchers n132 and Sven Sze during the TyphoonPWN 2026 competition, could allow attackers to hijack kernel control flow by referencing freed bridge memory.
The vulnerability stems from inconsistent cleanup behavior in the Linux bridge driver. When a bridge interface is administratively down but STP is enabled, certain timers such as hello_timer, tcn_timer, and port-specific timers may remain active even after the bridge’s underlying net_device is freed. This occurs because the dellink deletion path fails to invoke br_stp_disable_bridge(), leaving dangling timer entries pointing to deallocated memory.
An attacker with local access or the ability to manipulate bridge configurations could exploit this flaw by forcing a port into the LEARNING state, triggering timer activation without verifying the bridge’s operational status (IFF_UP flag). When the kernel later executes these timers in softirq context, it risks dereferencing freed memory, potentially enabling control-flow hijacking if the freed object is reclaimed with malicious data.
The issue was patched in Linux commit 2a00517db8de4be7df3d483b215c5544fb30a191, which addresses the cleanup inconsistency. Administrators are advised to apply the fix or update to kernel versions incorporating the patch to mitigate the risk. The disclosure was coordinated by SSD Secure Disclosure following the researchers’ second-place finish in the Linux privilege escalation category at TyphoonPWN 2026.
Source: https://gbhackers.com/poc-released-for-linux-kernel-stp/
Kernel Foundation - Master Linux Kernel & LDD cybersecurity rating report: https://www.rankiteo.com/company/linux-kernel-foundation
"id": "LIN1786019311",
"linkid": "linux-kernel-foundation",
"type": "Vulnerability",
"date": "1/2026",
"severity": "25",
"impact": "1",
"explanation": "Attack without any consequences"{'affected_entities': [{'customers_affected': 'All Linux users with bridge '
'interfaces and STP enabled',
'industry': 'Technology/Operating Systems',
'location': 'Global',
'name': 'Linux Kernel',
'type': 'Software'}],
'attack_vector': 'Local access or bridge configuration manipulation',
'customer_advisories': 'Administrators are advised to apply the patch or '
'update to kernel versions incorporating the fix to '
'mitigate the risk.',
'description': 'A proof-of-concept (PoC) exploit has been released for a '
'use-after-free vulnerability in the Linux kernel’s software '
'bridge implementation (net/bridge), specifically within the '
'Spanning Tree Protocol (STP) timer lifecycle. The flaw could '
'allow attackers to hijack kernel control flow by referencing '
'freed bridge memory due to inconsistent cleanup behavior in '
'the Linux bridge driver.',
'impact': {'operational_impact': 'Potential kernel control-flow hijacking, '
'system compromise',
'systems_affected': 'Linux systems with bridge interfaces and STP '
'enabled'},
'investigation_status': 'Patched',
'lessons_learned': 'Inconsistent cleanup behavior in kernel drivers can lead '
'to use-after-free vulnerabilities, emphasizing the need '
'for thorough validation of timer lifecycle management.',
'post_incident_analysis': {'corrective_actions': 'Patch applied to ensure '
'proper cleanup of STP '
'timers when bridge '
'interfaces are '
'administratively down.',
'root_causes': 'Inconsistent cleanup behavior in '
'the Linux bridge driver, where '
'`dellink` deletion path fails to '
'invoke `br_stp_disable_bridge()`, '
'leaving dangling timer entries '
'pointing to deallocated memory.'},
'recommendations': 'Apply the patch (Linux commit '
'`2a00517db8de4be7df3d483b215c5544fb30a191`) or update to '
'a kernel version incorporating the fix. Administrators '
'should audit bridge configurations and disable STP if not '
'required.',
'references': [{'source': 'SSD Secure Disclosure'},
{'source': 'TyphoonPWN 2026 Competition'}],
'response': {'containment_measures': 'Patch application (Linux commit '
'`2a00517db8de4be7df3d483b215c5544fb30a191`)',
'remediation_measures': 'Update to kernel versions incorporating '
'the patch'},
'title': 'Linux Kernel Vulnerability Exposes Systems to Control-Flow '
'Hijacking via STP Timer Flaw',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'Use-after-free in Linux kernel’s STP timer '
'lifecycle (CVE not specified)'}