A PoC has been made public for a use-after-free vulnerability within the Linux kernel’s implementation of software bridges and Spanning Tree Protocol (STP) timers This article explores protocol stp timers. . This flaw can cause queued STP timers to point back to freed bridge memory, potentially enabling a control-flow hijacking exploit under certain circumstances.
Researchers n132 and Sven Sze discovered this issue during TyphoonPWN 2026, where their work placed them second in the Linux privilege-escalation category. The PoC is available for the kernel’s net/bridge driver, which handles software Ethernet bridges and STP state transitions. These timer objects are embedded within struct net_bridge, which resides as private data inside the bridge interface's backing net_device.
When the dangling timer fires, it calls the function pointer stored in the timer structure while passing a pointer to the timer object. Practical exploitation would still require kernel configurations, heap behavior, namespace permissions, hardening features, and the attacker's ability to manipulate relevant networking objects. Administrators are advised to update their systems to a kernel with the patch, restrict untrusted users' creation or manipulation of network namespaces and bridge devices, and monitor for unusual netlink activity involving bridge creations, STP configurations, port-state changes, and rapid interface deletions.
This tool provides comprehensive phishing visibility, enhancing your Security Operations Center (SOC) effectiveness while reducing Mean Time To Repair (MTTR).
