CVE-2025-40297

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: fix use-after-free due to MST port state bypass

syzbot reported[1] a use-after-free when deleting an expired fdb. It is

due to a race condition between learning still happening and a port being

deleted, after all its fdbs have been flushed. The port's state has been

toggled to disabled so no learning should happen at that time, but if we

have MST enabled, it will bypass the port's state, that together with VLAN

filtering disabled can lead to fdb learning at a time when it shouldn't

happen while the port is being deleted. VLAN filtering must be disabled

because we flush the port VLANs when it's being deleted which will stop

learning. This fix adds a check for the port's vlan group which is

initialized to NULL when the port is getting deleted, that avoids the port

state bypass. When MST is enabled there would be a minimal new overhead

in the fast-path because the port's vlan group pointer is cache-hot.

[1

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References