In the Linux kernel, the following vulnerability has been resolved:
net: bridge: mst: fix vlan use-after-free
syzbot reported a suspicious rcu usage[1] in bridge's mst code. While fixing it I noticed that nothing prevents a vlan to be freed while walking the list from the same path (br forward delay timer). Fix the rcu usage and also make sure we are not accessing freed memory by making br_mst_vlan_set_state use rcu read lock.
[1] WARNING: suspicious RCU usage 6.9.0-rc6-syzkaller #0 Not tainted ----------------------------- net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage! ... stack backtrace: CPU: 1 PID: 8017 Comm: syz-executor.1 Not tainted 6.9.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712 nbp_vlan_group net/bridge/br_private.h:1599 [inline] br_mst_set_state+0x1ea/0x650 net/bridge/br_mst.c:105 br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47 br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88 call_timer_fn+0x18e/0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1844 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2429 run_timer_base kernel/time/timer.c:2438 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448 __do_softirq+0x2c6/0x980 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5758 Code: 2b 00 74 08 4c 89 f7 e8 ba d1 84 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25 RSP: 0018:ffffc90013657100 EFLAGS: 00000206 RAX: 0000000000000001 RBX: 1ffff920026cae2c RCX: 0000000000000001 RDX: dffffc0000000000 RSI: ffffffff8bcaca00 RDI: ffffffff8c1eaa60 RBP: ffffc90013657260 R08: ffffffff92efe507 R09: 1ffffffff25dfca0 R10: dffffc0000000000 R11: fffffbfff25dfca1 R12: 1ffff920026cae28 R13: dffffc0000000000 R14: ffffc90013657160 R15: 0000000000000246
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-debug-develUpgrade kernel-debug-modulesUpgrade rvUpgrade kernel-toolsUpgrade kernel-rt-debugUpgrade kernel-rt-kvmUpgrade kernel-rt-modulesUpgrade bpftoolUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rtUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-debug-coreUpgrade kernel-64k-develUpgrade kernel-64k-modules-extraUpgrade kernel-rt-coreUpgrade python3-perfUpgrade kernel-rt-develUpgrade kernel-debug-coreUpgrade kernel-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-docUpgrade kernel-rt-debug-modules-coreUpgrade kernel-develUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-tools-libsUpgrade perfUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-coreUpgrade kernel-debug-develUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-debugUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-develUpgrade kernel-headersUpgrade kernel-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-modules-coreUpgrade rtlaUpgrade kernel-rt-modules-coreUpgrade kernel-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-modulesUpgrade kernel-coreUpgrade kernel-debugUpgrade kernel-64k-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-64k-debug-modules-extraUpgrade kernel-devel-matchedUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdumpUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-coreUpgrade kernel-64kUpgrade libperfUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-modulesUpgrade kernel | Aug 12, 2024 | Jun 19, 2024 |
| Amazon_linux_2023 | — | Upgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel-modules-extra-commonUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-livepatch-6.1.94-99.176Upgrade python3-perf-debuginfoUpgrade kernel-libbpfUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-develUpgrade kernel-libbpf-staticUpgrade bpftoolUpgrade kernel | Feb 17, 2025 | Jun 19, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 19, 2024 |
| Oracle_linux | — | Upgrade kernel | Aug 16, 2024 | Jun 19, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Aug 12, 2024 | Jun 19, 2024 |
| Rocky_linux | — | Upgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-develUpgrade kernel-modules-coreUpgrade kernel-coreUpgrade kernelUpgrade kernel-rt-modulesUpgrade kernel-rt-debugUpgrade perfUpgrade kernel-rt-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-rtUpgrade kernel-rt-kvmUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-zfcpdump-devel-matchedUpgrade python3-perf-debuginfoUpgrade kernel-develUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debuginfoUpgrade kernel-debug-modulesUpgrade rvUpgrade kernel-debug-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debug-coreUpgrade python3-perfUpgrade kernel-debug-modules-coreUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-debuginfo-common-x86_64Upgrade libperfUpgrade bpftool-debuginfoUpgrade rtlaUpgrade perf-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-develUpgrade kernel-devel-matchedUpgrade kernel-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-tools-libs-develUpgrade kernel-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-debugUpgrade kernel-zfcpdump-modulesUpgrade kernel-cross-headersUpgrade kernel-headersUpgrade libperf-debuginfoUpgrade kernel-uki-virt | Aug 22, 2024 | Jun 19, 2024 |
| Suse | — | Upgrade kernel-rt_debugUpgrade kselftests-kmp-azureUpgrade kernel-64kbUpgrade kernel-default-develUpgrade kernel-macrosUpgrade kernel-source-azureUpgrade kernel-azure-optionalUpgrade reiserfs-kmp-64kbUpgrade gfs2-kmp-rtUpgrade dtb-allwinnerUpgrade kernel-64kb-optionalUpgrade kernel-symsUpgrade kernel-sourceUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-alteraUpgrade dtb-hisiliconUpgrade dtb-caviumUpgrade dtb-exynosUpgrade dtb-apmUpgrade kernel-default-livepatchUpgrade dtb-marvellUpgrade dtb-renesasUpgrade kernel-syms-azureUpgrade kernel-zfcpdumpUpgrade kernel-debug-develUpgrade kernel-azure-livepatch-develUpgrade dtb-broadcomUpgrade dlm-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade cluster-md-kmp-azureUpgrade dtb-amdUpgrade kernel-default-extraUpgrade gfs2-kmp-azureUpgrade kernel-64kb-develUpgrade gfs2-kmp-64kbUpgrade kernel-azure-extraUpgrade ocfs2-kmp-rtUpgrade dtb-freescaleUpgrade kernel-kvmsmall-develUpgrade kernel-devel-azureUpgrade dtb-lgUpgrade kernel-docs-htmlUpgrade dtb-amlogicUpgrade kernel-kvmsmallUpgrade kernel-obs-qaUpgrade ocfs2-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade dtb-appleUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-optionalUpgrade kernel-default-vdsoUpgrade kernel-source-vanillaUpgrade kernel-rt_debug-develUpgrade dtb-amazonUpgrade kernel-debugUpgrade kernel-source-rtUpgrade kernel-64kb-livepatch-develUpgrade kernel-devel-rtUpgrade kernel-default-baseUpgrade kernel-default-optionalUpgrade kernel-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-rt-vdsoUpgrade dtb-mediatekUpgrade kernel-rt-develUpgrade kernel-debug-livepatch-develUpgrade cluster-md-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-rtUpgrade kernel-debug-vdsoUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-armUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade kernel-rt-extraUpgrade dtb-xilinxUpgrade dtb-nvidiaUpgrade dtb-sprdUpgrade dtb-qcomUpgrade kernel-rt_debug-vdsoUpgrade kernel-azureUpgrade kernel-64kb-extraUpgrade ocfs2-kmp-azureUpgrade gfs2-kmp-defaultUpgrade kernel-azure-vdsoUpgrade reiserfs-kmp-rtUpgrade reiserfs-kmp-azureUpgrade kernel-obs-buildUpgrade kernel-default-base-rebuildUpgrade cluster-md-kmp-defaultUpgrade kernel-docsUpgrade kernel-develUpgrade dlm-kmp-defaultUpgrade dlm-kmp-azureUpgrade kernel-rt-livepatch-develUpgrade dlm-kmp-rtUpgrade kernel-azure-develUpgrade dtb-socionextUpgrade dtb-rockchipUpgrade kselftests-kmp-rt | Dec 5, 2025 | Sep 12, 2024 |
| Ubuntu | — | Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-nvidia-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-oem-24.04aUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1010-oemUpgrade linux-image-virtualUpgrade linux-image-gcpUpgrade linux-image-genericUpgrade linux-image-oem-24.04Upgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-40-genericUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1013-awsUpgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-raspiUpgrade linux-image-ibm-classicUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-oracleUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1012-azureUpgrade linux-image-awsUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-azure | Aug 9, 2024 | Jun 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Jun 19, 2024 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub