CVE-2025-40297

What it actually does

Use-after-free in Linux bridge FDB deletion caused by a race where MST-enabled port state bypass allows learning after VLANs are flushed and the port vlan_group pointer is set to NULL during deletion.

Why it matters to the business

Networking systems running affected kernels may experience crashes, memory corruption, or potential remote code execution, leading to service outages and unplanned downtime until kernels are updated.

How an attack unfolds

An attacker with local or network access configures MST on a bridge with VLAN filtering disabled, then triggers concurrent FDB learning and port deletion to hit the window where the stale port state permits access after the structure is freed.

How to fix it

Upgrade the Linux kernel to a version containing commit e19085b2a86addccff33ab8536fc67ebd9d52198 or later; rebuild and reboot with the patched kernel; verify the bridge code no longer bypasses port state when vlan_group is NULL.

How to confirm the fix worked

Confirm the running kernel contains commit e19085b2a86addccff33ab8536fc67ebd9d52198 via git describe or kernel version string; exercise bridge deletion under MST with VLAN filtering disabled and monitor for use-after-free reports.

Typical attack path

1. Enable MST and disable VLAN filtering on a bridge interface
2. Create conditions that populate FDB entries on a port
3. Initiate deletion of the port while learning events are still queued
4. Trigger the race that bypasses the disabled port state check
5. Cause access to freed FDB memory during expiration or cleanup

How to detect it

Review kernel logs and crash dumps for use-after-free reports involving bridge FDB operations or vlan_group checks; correlate with bridge interface configuration changes and MST enablement events.

• bridge: use-after-free
• net: bridge: fix use-after-free due to MST port state bypass
• vlan_group pointer NULL during fdb learning

What your security team should do

• Apply the fixed kernel commit immediately on all systems using bridge with MST
• Prioritize updates for internet-facing or multi-tenant hosts due to kernel-wide impact
• Disable MST or enable VLAN filtering as a temporary mitigation where operationally feasible
• Schedule kernel updates across the fleet within standard change windows