CVE-2025-40297 (GCVE-0-2025-40297)

Vulnerability from cvelistv5 – Published: 2025-12-08 00:46 – Updated: 2026-08-05 12:09
VLAI
Title
net: bridge: fix use-after-free due to MST port state bypass
Summary
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix use-after-free due to MST port state bypass syzbot reported[1] a use-after-free when deleting an expired fdb. It is due to a race condition between learning still happening and a port being deleted, after all its fdbs have been flushed. The port's state has been toggled to disabled so no learning should happen at that time, but if we have MST enabled, it will bypass the port's state, that together with VLAN filtering disabled can lead to fdb learning at a time when it shouldn't happen while the port is being deleted. VLAN filtering must be disabled because we flush the port VLANs when it's being deleted which will stop learning. This fix adds a check for the port's vlan group which is initialized to NULL when the port is getting deleted, that avoids the port state bypass. When MST is enabled there would be a minimal new overhead in the fast-path because the port's vlan group pointer is cache-hot. [1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: ec7328b59176227216c461601c6bd0e922232a9b , < e19085b2a86addccff33ab8536fc67ebd9d52198 (git)
Affected: ec7328b59176227216c461601c6bd0e922232a9b , < 3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8 (git)
Affected: ec7328b59176227216c461601c6bd0e922232a9b , < bf3843183bc3158e5821b46f330c438ae9bd6ddb (git)
Affected: ec7328b59176227216c461601c6bd0e922232a9b , < 991fbe1680cd41a5f97c92cd3a3496315df36e4b (git)
Affected: ec7328b59176227216c461601c6bd0e922232a9b , < 8dca36978aa80bab9d4da130c211db75c9e00048 (git)
Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.159 , ≤ 6.1.* (semver)
Unaffected: 6.6.117 , ≤ 6.6.* (semver)
Unaffected: 6.12.58 , ≤ 6.12.* (semver)
Unaffected: 6.17.8 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_forward.c",
            "net/bridge/br_input.c",
            "net/bridge/br_private.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e19085b2a86addccff33ab8536fc67ebd9d52198",
              "status": "affected",
              "version": "ec7328b59176227216c461601c6bd0e922232a9b",
              "versionType": "git"
            },
            {
              "lessThan": "3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8",
              "status": "affected",
              "version": "ec7328b59176227216c461601c6bd0e922232a9b",
              "versionType": "git"
            },
            {
              "lessThan": "bf3843183bc3158e5821b46f330c438ae9bd6ddb",
              "status": "affected",
              "version": "ec7328b59176227216c461601c6bd0e922232a9b",
              "versionType": "git"
            },
            {
              "lessThan": "991fbe1680cd41a5f97c92cd3a3496315df36e4b",
              "status": "affected",
              "version": "ec7328b59176227216c461601c6bd0e922232a9b",
              "versionType": "git"
            },
            {
              "lessThan": "8dca36978aa80bab9d4da130c211db75c9e00048",
              "status": "affected",
              "version": "ec7328b59176227216c461601c6bd0e922232a9b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_forward.c",
            "net/bridge/br_input.c",
            "net/bridge/br_private.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.117",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.58",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix use-after-free due to MST port state bypass\n\nsyzbot reported[1] a use-after-free when deleting an expired fdb. It is\ndue to a race condition between learning still happening and a port being\ndeleted, after all its fdbs have been flushed. The port\u0027s state has been\ntoggled to disabled so no learning should happen at that time, but if we\nhave MST enabled, it will bypass the port\u0027s state, that together with VLAN\nfiltering disabled can lead to fdb learning at a time when it shouldn\u0027t\nhappen while the port is being deleted. VLAN filtering must be disabled\nbecause we flush the port VLANs when it\u0027s being deleted which will stop\nlearning. This fix adds a check for the port\u0027s vlan group which is\ninitialized to NULL when the port is getting deleted, that avoids the port\nstate bypass. When MST is enabled there would be a minimal new overhead\nin the fast-path because the port\u0027s vlan group pointer is cache-hot.\n\n[1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggering the race requires locally issuing rtnetlink commands (create bridge, enable MST via IFLA_BRIDGE_MST, detach the port with RTM_SETLINK) concurrently with frame injection; the port-deletion half of the race cannot be driven by a remote peer.\nAC:L - The attacker controls both sides of the race \u2014 the packet flood on the veth peer and the timing of the port deletion \u2014 and the window spans the whole post-flush tail of del_nbp() (switchdev deferred processing, netdev_upper_dev_unlink notifiers, rx_handler unregister), so it is wide and can be retried in a loop.\nPR:L - All required operations are CAP_NET_ADMIN/CAP_NET_RAW rtnetlink and AF_PACKET calls gated by netlink_net_capable(), which an unprivileged user obtains over their own network namespace via unshare -Urn; no real root in the init namespace is needed.\nUI:N - The attacker performs the bridge setup, traffic generation, and port deletion entirely on their own; no victim action is involved.\nS:U - The use-after-free corrupts kernel memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale fdb-\u003edst is read after the net_bridge_port slab is freed and can be reclaimed with attacker-sprayed data, and fdb_fill_info() leaks dst-\u003edev-\u003eifindex from that attacker-chosen address into an RTM_DELNEIGH netlink broadcast readable from userspace \u2014 an arbitrary kernel read primitive.\nI:H - The surviving fdb entry stays in the hash table and is used for forwarding, so br_forward(dst-\u003edst, ...) dereferences the freed port\u0027s -\u003edev and reaches dev_queue_xmit(), giving an indirect call through function pointers read from the reclaimed slab \u2014 a control-flow hijack primitive.\nA:H - Even without grooming, dereferencing the freed net_bridge_port during fdb expiry or forwarding oopses the kernel; this is the use-after-free syzbot originally reported."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:19.467Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e19085b2a86addccff33ab8536fc67ebd9d52198"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf3843183bc3158e5821b46f330c438ae9bd6ddb"
        },
        {
          "url": "https://git.kernel.org/stable/c/991fbe1680cd41a5f97c92cd3a3496315df36e4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/8dca36978aa80bab9d4da130c211db75c9e00048"
        }
      ],
      "title": "net: bridge: fix use-after-free due to MST port state bypass",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40297",
    "datePublished": "2025-12-08T00:46:21.112Z",
    "dateReserved": "2025-04-16T07:20:57.185Z",
    "dateUpdated": "2026-08-05T12:09:19.467Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40297",
      "date": "2026-08-09",
      "epss": "0.00154",
      "percentile": "0.0503"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40297\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-08T01:16:01.813\",\"lastModified\":\"2026-07-30T06:24:27.157\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: bridge: fix use-after-free due to MST port state bypass\\n\\nsyzbot reported[1] a use-after-free when deleting an expired fdb. It is\\ndue to a race condition between learning still happening and a port being\\ndeleted, after all its fdbs have been flushed. The port\u0027s state has been\\ntoggled to disabled so no learning should happen at that time, but if we\\nhave MST enabled, it will bypass the port\u0027s state, that together with VLAN\\nfiltering disabled can lead to fdb learning at a time when it shouldn\u0027t\\nhappen while the port is being deleted. VLAN filtering must be disabled\\nbecause we flush the port VLANs when it\u0027s being deleted which will stop\\nlearning. This fix adds a check for the port\u0027s vlan group which is\\ninitialized to NULL when the port is getting deleted, that avoids the port\\nstate bypass. When MST is enabled there would be a minimal new overhead\\nin the fast-path because the port\u0027s vlan group pointer is cache-hot.\\n\\n[1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bridge/br_forward.c\",\"net/bridge/br_input.c\",\"net/bridge/br_private.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ec7328b59176227216c461601c6bd0e922232a9b\",\"lessThan\":\"e19085b2a86addccff33ab8536fc67ebd9d52198\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec7328b59176227216c461601c6bd0e922232a9b\",\"lessThan\":\"3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec7328b59176227216c461601c6bd0e922232a9b\",\"lessThan\":\"bf3843183bc3158e5821b46f330c438ae9bd6ddb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec7328b59176227216c461601c6bd0e922232a9b\",\"lessThan\":\"991fbe1680cd41a5f97c92cd3a3496315df36e4b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec7328b59176227216c461601c6bd0e922232a9b\",\"lessThan\":\"8dca36978aa80bab9d4da130c211db75c9e00048\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bridge/br_forward.c\",\"net/bridge/br_input.c\",\"net/bridge/br_private.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.159\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.117\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.58\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.8\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8dca36978aa80bab9d4da130c211db75c9e00048\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/991fbe1680cd41a5f97c92cd3a3496315df36e4b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bf3843183bc3158e5821b46f330c438ae9bd6ddb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e19085b2a86addccff33ab8536fc67ebd9d52198\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:38:37+00:00",
      "cve": "CVE-2025-40297",
      "id": "CVE-2025-40297",
      "initial_release_date": "2025-12-08T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: bridge: fix use-after-free due to MST port state bypass",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40297.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-25T00:31:50Z",
      "cve": "CVE-2025-40297",
      "id": "CVE-2025-40297",
      "initial_release_date": "2025-12-09T00:24:42Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "449",
      "product_status:known_not_affected": "266",
      "product_status:recommended": "484",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40297",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40297.json",
      "version": "48"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.