Public PoC Released for Linux Kernel Bridge Use-After-Free Vulnerability

A public proof-of-concept has been released for a use-after-free flaw affecting the Linux kernel’s bridge subsystem, specifically its Spanning Tree Protocol implementation in net/bridge.

The issue can leave STP timers active after the bridge network device that owns them has been deleted, creating a dangerous memory-safety condition in the kmalloc-cg-8k slab cache.

The use-after-free vulnerability occurs when kernel STP is enabled on an administratively down bridge and a bridge port transitions to the LEARNING state.

In this condition, the kernel can arm periodic STP timers without checking the IFF_UP interface flag. These timers support the STP state machine, which prevents Layer 2 loops by managing bridge-port states and network topology changes.

Linux stores timers such as hello_timer, tcn_timer, topology_change_timer, and port-specific timers inside struct net_bridge. That structure is held in the private data area of the bridge’s net_device.

As a result, the timers must be removed before the backing network device is released. If they remain queued after the memory is freed, the kernel may later attempt to execute a timer callback through a stale memory reference.

Linux Kernel Bridge Use-After-Free Vulnerability

According to SSD Disclosure, the bug stems from different cleanup behavior between normal interface shutdown and direct bridge deletion.

During a standard UP-to-DOWN transition, the ndo_stop path reaches br_stp_disable_bridge(), which synchronously cancels STP timers through del_timer_sync(). This prevents pending callbacks from accessing released bridge data.

However, deleting a bridge via the delink path invokes br_dev_delete() and does not trigger the same STP cleanup routine. If the interface is already down, the device-unregistration process can also skip ndo_stop.

This leaves armed timers attached to a per-CPU timer base even though the associated net_device is subsequently freed. When the kernel’s timer processing routine later handles the dangling timer in softirq context, it may dereference freed memory.

Researchers noted that controlled reallocation of the released slab object could potentially turn the bug into a control-flow hijacking primitive, raising the impact beyond a crash or denial-of-service scenario.

The public PoC demonstrates the affected lifecycle and underscores the importance of timely remediation in environments that allow bridge configuration changes.

A Linux kernel patch has been introduced in commit 2a00517db8de4be7df3d483b215c5544fb30a191. Systems running kernels before that change should be treated as affected and updated via their distribution’s supported kernel packages.

Until patched kernels are deployed, administrators should restrict untrusted users’ ability to create, modify, or remove bridge interfaces and review workloads that use kernel STP.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.