CVE-2024-40920

What it actually does

Incorrect RCU dereference helper used for VLAN group in br_mst_set_state after conversion to RCU, allowing potential use-after-free on VLAN objects in Linux bridge MST code.

Why it matters to the business

Systems running affected kernels risk kernel warnings, instability, or crashes in bridged network environments; low urgency given absence from KEV and flat low EPSS trend, though Linux kernel prevalence means broad downstream impact across servers and appliances.

How an attack unfolds

An attacker with local or network access to a system using bridge MST would attempt to trigger VLAN state changes concurrently with RCU-protected operations to exploit the mismatched dereference and cause a use-after-free, though no named threat actors or public exploits are associated with this specific flaw.

How to fix it

Upgrade the Linux kernel to a version containing commit a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6 or apply the equivalent stable backport for the running distribution.

How to confirm the fix worked

Verify the presence of the fix commit in the kernel source tree or confirm the running kernel version includes the corrected vlan group RCU dereference helper; recompile and test for absence of RCU warnings under bridge MST load.

Typical attack path

1. Locate Linux kernel versions prior to the fix commit
2. Configure or interact with bridge MST and VLAN features
3. Induce concurrent state changes to trigger the RCU path
4. Attempt to leverage resulting use-after-free for memory corruption or denial of service

How to detect it

Search kernel logs and dmesg for RCU suspicious usage messages referencing br_mst_set_state or vlan group dereferences; monitor for unexpected bridge MST state changes or related crashes.

What your security team should do

• Prioritize kernel updates on systems using network bridging and MST
• Review kernel logs for RCU-related warnings on bridge devices
• Apply the patch or distribution update within standard maintenance windows given low exploit maturity