CVE-2025-40297net: bridge: fix use-after-free due to MST port state bypass
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix use-after-free due to MST port state bypass syzbot reported[1] a use-after-free when deleting an expired fdb. It is due to a race condition between learning still happening and a port being deleted, after all its fdbs have been flushed. The port's state has been toggled to disabled so no learning should happen at that time, but if we have MST enabled, it will bypass the port's state, that together with VLAN filtering disabled can lead to fdb learning at a time when it shouldn't happen while the port is being deleted. VLAN filtering must be disabled because we flush the port VLANs when it's being deleted which will stop learning. This fix adds a check for the port's vlan group which is initialized to NULL when the port is getting deleted, that avoids the port state bypass. When MST is enabled there would be a minimal new overhead in the fast-path because the port's vlan group pointer is cache-hot. [1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ec7328b59176227216c461601c6bd0e922232a9b before e19085b2a86addccff33ab8536fc67ebd9d52198; from ec7328b59176227216c461601c6bd0e922232a9b before 3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8; from ec7328b59176227216c461601c6bd0e922232a9b before bf3843183bc3158e5821b46f330c438ae9bd6ddb; from ec7328b59176227216c461601c6bd0e922232a9b before 991fbe1680cd41a5f97c92cd3a3496315df36e4b; from ec7328b59176227216c461601c6bd0e922232a9b before 8dca36978aa80bab9d4da130c211db75c9e00048 | CNA record |
References
- https://git.kernel.org/stable/c/e19085b2a86addccff33ab8536fc67ebd9d52198
- https://git.kernel.org/stable/c/3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8
- https://git.kernel.org/stable/c/bf3843183bc3158e5821b46f330c438ae9bd6ddb
- https://git.kernel.org/stable/c/991fbe1680cd41a5f97c92cd3a3496315df36e4b
- https://git.kernel.org/stable/c/8dca36978aa80bab9d4da130c211db75c9e00048
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.