CVE-2021-47160

What it actually does

The mt7530 DSA driver fails to clear the PCR_MATRIX field when VLAN filtering is disabled on a bridge after it was enabled, allowing switch ports to retain forwarding matrix settings that permit cross-bridge traffic leakage.

Why it matters to the business

Network segmentation intended to isolate traffic between separate bridges can be bypassed, resulting in unintended data exposure across network segments in systems using affected mt7530 hardware.

How an attack unfolds

An attacker with local network configuration privileges creates multiple VLAN-filtered bridges, assigns distinct switch ports to each, then disables VLAN filtering on those bridges; the uncleared PCR_MATRIX allows frames to leak between the bridges, enabling interception of traffic that should remain isolated.

How to fix it

Update the Linux kernel to a version containing the upstream fix that removes the PCR_MATRIX write from mt7530_port_set_vlan_aware and relies exclusively on the port_bridge_add and port_bridge_del helpers to manage the matrix.

How to confirm the fix worked

Inspect the mt7530 driver source for removal of the PCR_MATRIX assignment inside mt7530_port_set_vlan_aware; confirm that port_bridge_add and port_bridge_del correctly program the register; test the reproduction sequence to verify no leakage occurs after disabling VLAN filtering.

Typical attack path

1. Create multiple bridge interfaces and enable VLAN filtering on each
2. Assign distinct mt7530 switch ports to different bridges
3. Disable VLAN filtering on the bridges
4. Capture or forward traffic that now leaks across bridge boundaries

How to detect it

Examine system logs for repeated bridge VLAN filtering enable/disable sequences on mt7530 ports; monitor switch port counters and bridge forwarding tables for unexpected cross-bridge traffic after configuration changes.

What your security team should do

• Prioritize kernel updates on systems containing mt7530 DSA switches
• Review bridge and VLAN configurations for multi-bridge setups sharing the switch
• Implement network segmentation verification tests after patching