Linux Kernel Bridge Subsystem Hit by Use-After-Free Vulnerability
A recently disclosed proof-of-concept (PoC) exploit highlights a critical use-after-free flaw in the Linux kernel’s bridge subsystem, specifically within its Spanning Tree Protocol (STP) implementation. The vulnerability, tracked in the net/bridge component, arises when STP timers remain active after their associated bridge network device is deleted, leading to a memory-safety risk in the kmalloc-cg-8k slab cache.
The issue manifests when kernel STP is enabled on an administratively down bridge, and a bridge port transitions to the LEARNING state. Under these conditions, the kernel may arm periodic STP timers such as hello_timer, tcn_timer, and topology_change_timer without verifying the IFF_UP interface flag. These timers, stored in the struct net_bridge structure, are tied to the bridge’s net_device private data. If the timers persist after the device is freed, subsequent callback execution via stale memory references can trigger a use-after-free condition.
The root cause lies in inconsistent cleanup behavior between interface shutdowns and direct bridge deletions. During a standard UP-to-DOWN transition, the ndo_stop path invokes br_stp_disable_bridge(), which synchronously cancels STP timers using del_timer_sync(). However, deleting a bridge via the delink path or unregistering a downed interface bypasses this cleanup, leaving armed timers attached to a per-CPU timer base. When the kernel’s timer processing routine later attempts to execute these dangling timers in softirq context, it risks dereferencing freed memory.
Researchers warn that controlled reallocation of the freed slab object could escalate the flaw into a control-flow hijacking primitive, extending its impact beyond crashes or denial-of-service (DoS) scenarios. The public PoC demonstrates the vulnerability’s lifecycle, emphasizing the need for prompt remediation in environments where bridge configurations are dynamic.
A patch addressing the issue was introduced in Linux kernel commit 2a00517db8de4be7df3d483b215c5544fb30a191. Systems running earlier kernel versions are considered vulnerable and should be updated through their distribution’s supported packages. Until patches are applied, administrators are advised to restrict untrusted users from creating, modifying, or removing bridge interfaces and to audit workloads leveraging kernel STP.
Source: https://cybersecuritynews.com/linux-kernel-bridge-use-after-free-vulnerability/
Linux Kernel TPRM report: https://www.rankiteo.com/company/linux-kernel-foundation
"id": "lin1786026478",
"linkid": "linux-kernel-foundation",
"type": "Vulnerability",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'All Linux distributions using '
'vulnerable kernel versions',
'industry': 'Technology/Operating Systems',
'location': 'Global',
'name': 'Linux Kernel',
'type': 'Open-source software'}],
'attack_vector': 'Local exploitation via bridge interface manipulation',
'description': 'A critical use-after-free flaw in the Linux kernel’s bridge '
'subsystem, specifically within its Spanning Tree Protocol '
'(STP) implementation, was disclosed via a proof-of-concept '
'(PoC) exploit. The vulnerability arises when STP timers '
'remain active after their associated bridge network device is '
'deleted, leading to a memory-safety risk in the '
'`kmalloc-cg-8k` slab cache. The issue can potentially '
'escalate into control-flow hijacking if the freed slab object '
'is reallocated.',
'impact': {'operational_impact': 'Potential denial-of-service (DoS) or '
'control-flow hijacking',
'systems_affected': 'Linux systems with kernel STP enabled on '
'bridge interfaces'},
'investigation_status': 'Patch available; vulnerability publicly disclosed',
'lessons_learned': 'Inconsistent cleanup behavior between interface shutdowns '
'and bridge deletions can lead to use-after-free '
'vulnerabilities. Proper timer synchronization is critical '
'in kernel subsystems.',
'post_incident_analysis': {'corrective_actions': 'Patch applied to ensure '
'proper timer '
'synchronization; improved '
'kernel subsystem cleanup '
'logic.',
'root_causes': 'Inconsistent cleanup of STP timers '
'during bridge deletion, leading to '
'use-after-free conditions in the '
'`kmalloc-cg-8k` slab cache.'},
'recommendations': '1) Apply the patch immediately; 2) Restrict bridge '
'interface management to trusted users; 3) Audit systems '
'for dynamic bridge configurations; 4) Monitor for '
'exploitation attempts.',
'references': [{'source': 'Linux Kernel Commit',
'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2a00517db8de4be7df3d483b215c5544fb30a191'}],
'response': {'containment_measures': 'Restrict untrusted users from '
'creating/modifying/deleting bridge '
'interfaces; audit workloads using '
'kernel STP',
'remediation_measures': 'Apply patch (Linux kernel commit '
'2a00517db8de4be7df3d483b215c5544fb30a191) '
'via distribution-supported packages'},
'stakeholder_advisories': 'Linux distribution maintainers and system '
'administrators should prioritize patching '
'vulnerable systems.',
'title': 'Linux Kernel Bridge Subsystem Use-After-Free Vulnerability',
'type': 'Use-After-Free Vulnerability',
'vulnerability_exploited': 'CVE not specified (Linux kernel `net/bridge` '
'component, STP timers)'}