A public proof-of-concept has been released for a use-after-free vulnerability in the Linux kernel's bridge subsystem, specifically impacting Spanning Tree Protocol (STP) implementation within net/bridge. This flaw can leave STP timers active after the associated bridge device is deleted, leading to a dangerous memory-safety issue in the kmalloc-cg-8k slab cache. Linux stores timers like hello_timer, tcn_timer, topology_change_timer, and port-specific ones within struct net_bridge, which is part of a network device's private data area.
The Linux Kernel Bridge Use-After-Free Vulnerability is linked to different cleanup behaviors between normal interface shutdown and direct bridge deletion, as disclosed by SSD Disclosure. This prevents pending callbacks from accessing released bridge data.
Researchers identified how controlled reallocation of released slab objects could turn this bug into a control-flow hijacking primitive, expanding its impact beyond crashes or denial-of-service scenarios. The public PoC illustrates the affected lifecycle and highlights the urgency for timely remediation in environments allowing bridge configuration changes. Before deploying patched kernels, administrators must limit untrusted users' capabilities for creating, modifying, or deleting bridge interfaces and scrutinize the workloads utilizing kernel Spanning Tree Protocol (STP).
