In the Linux kernel, the following vulnerability has been resolved:
net: bridge: mst: fix vlan use-after-free
syzbot reported a suspicious rcu usage[1] in bridge's mst code. While fixing it I noticed that nothing prevents a vlan to be freed while walking the list from the same path (br forward delay timer). Fix the rcu usage and also make sure we are not accessing freed memory by making br_mst_vlan_set_state use rcu read lock.
[1] WARNING: suspicious RCU usage 6.9.0-rc6-syzkaller #0 Not tainted ----------------------------- net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage! ... stack backtrace: CPU: 1 PID: 8017 Comm: syz-executor.1 Not tainted 6.9.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712 nbp_vlan_group net/bridge/br_private.h:1599 [inline] br_mst_set_state+0x1ea/0x650 net/bridge/br_mst.c:105 br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47 br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88 call_timer_fn+0x18e/0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1844 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2429 run_timer_base kernel/time/timer.c:2438 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448 __do_softirq+0x2c6/0x980 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5758 Code: 2b 00 74 08 4c 89 f7 e8 ba d1 84 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25 RSP: 0018:ffffc90013657100 EFLAGS: 00000206 RAX: 0000000000000001 RBX: 1ffff920026cae2c RCX: 0000000000000001 RDX: dffffc0000000000 RSI: ffffffff8bcaca00 RDI: ffffffff8c1eaa60 RBP: ffffc90013657260 R08: ffffffff92efe507 R09: 1ffffffff25dfca0 R10: dffffc0000000000 R11: fffffbfff25dfca1 R12: 1ffff920026cae28 R13: dffffc0000000000 R14: ffffc90013657160 R15: 0000000000000246
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-devel-matchedUpgrade libperfUpgrade kernelUpgrade kernel-zfcpdumpUpgrade kernel-modules-coreUpgrade kernel-debug-develUpgrade kernel-64k-debug-modules-extraUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-cross-headersUpgrade kernel-coreUpgrade kernel-modulesUpgrade kernel-64kUpgrade kernel-64k-modules-coreUpgrade kernel-64k-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdump-modulesUpgrade kernel-debugUpgrade kernel-uki-virtUpgrade rtlaUpgrade kernel-debug-devel-matchedUpgrade kernel-tools-libs-develUpgrade kernel-headersUpgrade kernel-64k-debugUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64k-coreUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-coreUpgrade python3-perfUpgrade kernel-develUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-modules-extraUpgrade kernel-debug-uki-virtUpgrade perfUpgrade kernel-debug-modulesUpgrade kernel-64k-debug-develUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-kvmUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-tools-libsUpgrade kernel-64k-develUpgrade kernel-rtUpgrade kernel-docUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-debug-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-toolsUpgrade kernel-rt-modules-extraUpgrade bpftoolUpgrade rvUpgrade kernel-rt-modulesUpgrade kernel-rt-develUpgrade kernel-rt-debugUpgrade kernel-modules-extraUpgrade kernel-rt-core | Aug 12, 2024 | Jun 19, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpfUpgrade kernel-livepatch-6.1.94-99.176Upgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade kernel-debuginfoUpgrade kernelUpgrade bpftoolUpgrade python3-perf-debuginfoUpgrade kernel-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-libbpf-develUpgrade python3-perfUpgrade perfUpgrade kernel-develUpgrade kernel-modules-extra-commonUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel-toolsUpgrade kernel-tools-devel | Feb 17, 2025 | Jun 19, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 19, 2024 |
| Oracle_linux | — | Upgrade kernel | Aug 16, 2024 | Jun 19, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Aug 12, 2024 | Jun 19, 2024 |
| Rocky_linux | — | Upgrade perfUpgrade bpftoolUpgrade kernel-rt-develUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modulesUpgrade kernel-rtUpgrade kernel-rt-modules-extraUpgrade kernel-debug-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-kvmUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-debug-modules-coreUpgrade kernel-rt-coreUpgrade rvUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-tools-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debug-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-modules-extraUpgrade kernel-rt-debugUpgrade kernel-rt-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-toolsUpgrade kernel-develUpgrade kernel-rt-debug-modulesUpgrade libperfUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-coreUpgrade kernel-modules-coreUpgrade kernel-debug-develUpgrade kernelUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-rt-debug-kvmUpgrade kernel-modulesUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-coreUpgrade rtlaUpgrade perf-debuginfoUpgrade kernel-zfcpdumpUpgrade libperf-debuginfoUpgrade kernel-headersUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-debugUpgrade kernel-cross-headers | Aug 22, 2024 | Jun 19, 2024 |
| Suse | — | Upgrade kernel-debug-vdsoUpgrade dtb-mediatekUpgrade kernel-debug-livepatch-develUpgrade kernel-syms-rtUpgrade kernel-rt-develUpgrade kernel-azureUpgrade kernel-rt_debug-vdsoUpgrade dtb-sprdUpgrade ocfs2-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade cluster-md-kmp-rtUpgrade reiserfs-kmp-rtUpgrade kernel-default-baseUpgrade kernel-devel-rtUpgrade kernel-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-develUpgrade dtb-socionextUpgrade dtb-rockchipUpgrade kernel-rtUpgrade cluster-md-kmp-64kbUpgrade dtb-armUpgrade kselftests-kmp-defaultUpgrade dtb-xilinxUpgrade dlm-kmp-azureUpgrade kernel-rt-extraUpgrade kernel-default-optionalUpgrade kernel-rt-vdsoUpgrade dlm-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-obs-buildUpgrade kernel-docsUpgrade kernel-azure-vdsoUpgrade kernel-default-base-rebuildUpgrade reiserfs-kmp-azureUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-rtUpgrade kernel-azure-develUpgrade cluster-md-kmp-defaultUpgrade dtb-nvidiaUpgrade kernel-64kb-extraUpgrade dtb-qcomUpgrade gfs2-kmp-defaultUpgrade kernel-syms-azureUpgrade kernel-default-vdsoUpgrade kernel-azure-optionalUpgrade kernel-sourceUpgrade kernel-rt-optionalUpgrade dtb-amdUpgrade dtb-allwinnerUpgrade kernel-64kb-optionalUpgrade kernel-kvmsmall-livepatch-develUpgrade ocfs2-kmp-defaultUpgrade kernel-azure-extraUpgrade dtb-freescaleUpgrade ocfs2-kmp-rtUpgrade kernel-debug-develUpgrade ocfs2-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade kernel-zfcpdumpUpgrade kernel-rt_debugUpgrade dtb-caviumUpgrade dtb-amazonUpgrade kernel-macrosUpgrade kernel-64kbUpgrade kernel-source-azureUpgrade kernel-default-develUpgrade reiserfs-kmp-64kbUpgrade kernel-obs-qaUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-azureUpgrade kernel-kvmsmallUpgrade kernel-docs-htmlUpgrade dtb-lgUpgrade dtb-amlogicUpgrade kselftests-kmp-64kbUpgrade kernel-source-vanillaUpgrade kernel-64kb-livepatch-develUpgrade kernel-source-rtUpgrade kernel-rt_debug-develUpgrade dtb-appleUpgrade dlm-kmp-64kbUpgrade kernel-devel-azureUpgrade kernel-default-extraUpgrade kernel-debugUpgrade dtb-broadcomUpgrade kernel-azure-livepatch-develUpgrade cluster-md-kmp-azureUpgrade kernel-default-livepatchUpgrade reiserfs-kmp-defaultUpgrade dtb-marvellUpgrade dtb-exynosUpgrade dtb-apmUpgrade dtb-renesasUpgrade dtb-hisiliconUpgrade dtb-alteraUpgrade kernel-symsUpgrade gfs2-kmp-rtUpgrade kselftests-kmp-azureUpgrade kernel-64kb-develUpgrade gfs2-kmp-64kb | Dec 5, 2025 | Sep 12, 2024 |
| Ubuntu | — | Upgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-gcpUpgrade linux-image-gkeUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-oracle-64kUpgrade linux-image-genericUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1010-oemUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-24.04Upgrade linux-image-generic-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-azureUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-awsUpgrade linux-image-raspiUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1012-azureUpgrade linux-image-6.8.0-1013-awsUpgrade linux-image-kvmUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-ibmUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-oracleUpgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-6.8.0-40-genericUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1012-azure-fde | Aug 9, 2024 | Jun 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Jun 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub