CVE-2024-40921

What it actually does

The flaw is an improper RCU-protected dereference of a VLAN group pointer inside br_mst_vlan_set_state() callers in the Linux bridge MST implementation, allowing a window for concurrent modification or use of stale data.

Why it matters to the business

Kernel-level instability or crashes in networking stacks on Linux systems using bridge MST can interrupt network connectivity, increase operational overhead for patching large fleets, and raise risk in environments with high bridge usage.

How an attack unfolds

An attacker with local or network-adjacent access triggers concurrent bridge MST VLAN state changes while the pointer is re-dereferenced, exploiting the RCU window to cause invalid memory access or data corruption; listed threat actors have targeted similar Linux kernel resource-handling bugs in zero-day campaigns.

How to fix it

Upgrade the Linux kernel to commit a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6 or later; rebuild and deploy the updated kernel image across all affected systems; verify the change is present by inspecting the br_mst.c source.

How to confirm the fix worked

Confirm the fixed commit appears in the running kernel source tree or package changelog; exercise bridge MST VLAN state transitions under concurrent load while monitoring for RCU warnings or crashes; re-scan with kernel static-analysis tools for remaining suspicious dereferences.

Typical attack path

1. Obtain local or adjacent network access to a Linux host running the vulnerable kernel with bridge MST enabled
2. Trigger rapid or concurrent VLAN group state updates via netlink or bridge configuration interfaces
3. Race the second dereference inside br_mst_vlan_set_state against RCU grace-period reclamation
4. Induce kernel oops, memory corruption, or denial of service

How to detect it

Search kernel logs for RCU-related warnings mentioning br_mst_vlan_set_state or vlan_group dereferences; inspect audit logs for unusual bridge netlink activity around the time of any kernel oops; correlate with process execution of bridge utilities or netlink senders.

What your security team should do

• Prioritize kernel upgrades on all systems that use the bridge MST feature within the next 30 days
• Add the fixed commit hash to internal patch-management tracking
• Enable CONFIG_RCU_STRICT_GRACE_PERIOD and dynamic debug for bridge during validation windows
• Review bridge configuration to determine if MST can be disabled where not required