In the Linux kernel, the following vulnerability has been resolved:
net: bridge: mst: fix vlan use-after-free
syzbot reported a suspicious rcu usage[1] in bridge's mst code. While fixing it I noticed that nothing prevents a vlan to be freed while walking the list from the same path (br forward delay timer). Fix the rcu usage and also make sure we are not accessing freed memory by making br_mst_vlan_set_state use rcu read lock.
[1] WARNING: suspicious RCU usage 6.9.0-rc6-syzkaller #0 Not tainted ----------------------------- net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage! ... stack backtrace: CPU: 1 PID: 8017 Comm: syz-executor.1 Not tainted 6.9.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712 nbp_vlan_group net/bridge/br_private.h:1599 [inline] br_mst_set_state+0x1ea/0x650 net/bridge/br_mst.c:105 br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47 br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88 call_timer_fn+0x18e/0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1844 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2429 run_timer_base kernel/time/timer.c:2438 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448 __do_softirq+0x2c6/0x980 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5758 Code: 2b 00 74 08 4c 89 f7 e8 ba d1 84 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25 RSP: 0018:ffffc90013657100 EFLAGS: 00000206 RAX: 0000000000000001 RBX: 1ffff920026cae2c RCX: 0000000000000001 RDX: dffffc0000000000 RSI: ffffffff8bcaca00 RDI: ffffffff8c1eaa60 RBP: ffffc90013657260 R08: ffffffff92efe507 R09: 1ffffffff25dfca0 R10: dffffc0000000000 R11: fffffbfff25dfca1 R12: 1ffff920026cae28 R13: dffffc0000000000 R14: ffffc90013657160 R15: 0000000000000246
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-coreUpgrade kernel-64k-debug-develUpgrade kernel-modules-extraUpgrade perfUpgrade rvUpgrade kernel-docUpgrade kernel-debug-modulesUpgrade kernel-develUpgrade kernel-64k-debug-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-develUpgrade kernel-64k-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-rt-debugUpgrade kernel-rt-develUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-64k-debug-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-debug-coreUpgrade kernel-rtUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-cross-headersUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-64kUpgrade kernel-headersUpgrade kernel-debug-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-64k-modulesUpgrade rtlaUpgrade kernelUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-abi-stablelistsUpgrade kernel-uki-virtUpgrade kernel-devel-matchedUpgrade kernel-64k-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-kvmUpgrade kernel-tools-libs-develUpgrade kernel-modulesUpgrade kernel-modules-coreUpgrade kernel-coreUpgrade kernel-debugUpgrade libperfUpgrade kernel-64k-debug-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-coreUpgrade kernel-64k-debug | Aug 12, 2024 | Jun 19, 2024 |
| Amazon_linux_2023 | — | Upgrade perf-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade perfUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade kernel-headersUpgrade bpftoolUpgrade kernel-livepatch-6.1.94-99.176Upgrade bpftool-debuginfoUpgrade kernel-libbpfUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-extraUpgrade kernel-libbpf-develUpgrade kernel-libbpf-staticUpgrade kernelUpgrade python3-perf-debuginfo | Feb 17, 2025 | Jun 19, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 19, 2024 |
| Oracle_linux | — | Upgrade kernel | Aug 16, 2024 | Jun 19, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Aug 12, 2024 | Jun 19, 2024 |
| Rocky_linux | — | Upgrade kernel-zfcpdump-coreUpgrade kernel-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debugUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-modules-extraUpgrade kernel-headersUpgrade kernel-rt-debug-kvmUpgrade kernel-modulesUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-modulesUpgrade bpftool-debuginfoUpgrade perf-debuginfoUpgrade rtlaUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-debuginfoUpgrade libperfUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-develUpgrade kernel-tools-libs-develUpgrade kernel-uki-virtUpgrade kernelUpgrade kernel-debug-develUpgrade libperf-debuginfoUpgrade kernel-modules-coreUpgrade kernel-modules-extraUpgrade kernel-debug-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rtUpgrade bpftoolUpgrade python3-perfUpgrade kernel-rt-kvmUpgrade kernel-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-uki-virtUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-develUpgrade kernel-rt-debugUpgrade rvUpgrade kernel-rt-coreUpgrade kernel-debug-modules-coreUpgrade kernel-toolsUpgrade kernel-debug-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-coreUpgrade perfUpgrade kernel-rt-modulesUpgrade kernel-rt-devel | Aug 22, 2024 | Jun 19, 2024 |
| Suse | — | Upgrade kernel-obs-buildUpgrade reiserfs-kmp-azureUpgrade dtb-socionextUpgrade kernel-defaultUpgrade kernel-default-baseUpgrade kernel-default-livepatch-develUpgrade dtb-qcomUpgrade ocfs2-kmp-azureUpgrade kernel-azureUpgrade dtb-sprdUpgrade kernel-rt-livepatch-develUpgrade kernel-azure-develUpgrade kernel-rt_debug-vdsoUpgrade cluster-md-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade dtb-armUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-default-optionalUpgrade kernel-rt-extraUpgrade dlm-kmp-azureUpgrade dlm-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-64kb-extraUpgrade kernel-docsUpgrade dtb-nvidiaUpgrade kernel-develUpgrade gfs2-kmp-defaultUpgrade dtb-xilinxUpgrade kernel-default-base-rebuildUpgrade kernel-devel-rtUpgrade kernel-rtUpgrade kernel-azure-vdsoUpgrade kernel-syms-rtUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-rtUpgrade dtb-mediatekUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-rtUpgrade dtb-rockchipUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-develUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-azure-livepatch-develUpgrade kernel-symsUpgrade dtb-marvellUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmall-vdsoUpgrade ocfs2-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-default-vdsoUpgrade kernel-64kb-develUpgrade ocfs2-kmp-defaultUpgrade kernel-obs-qaUpgrade gfs2-kmp-azureUpgrade gfs2-kmp-64kbUpgrade dtb-freescaleUpgrade kernel-azure-extraUpgrade kernel-zfcpdumpUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-rtUpgrade kernel-syms-azureUpgrade kernel-sourceUpgrade kselftests-kmp-azureUpgrade dtb-broadcomUpgrade dtb-amdUpgrade cluster-md-kmp-azureUpgrade kernel-debug-develUpgrade kselftests-kmp-64kbUpgrade kernel-kvmsmallUpgrade dtb-hisiliconUpgrade dtb-alteraUpgrade kernel-docs-htmlUpgrade dtb-renesasUpgrade kernel-64kbUpgrade dtb-caviumUpgrade dtb-appleUpgrade dlm-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-rt_debug-develUpgrade kernel-devel-azureUpgrade kernel-default-extraUpgrade kernel-debugUpgrade kernel-64kb-livepatch-develUpgrade dtb-lgUpgrade kernel-source-vanillaUpgrade dtb-amlogicUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-allwinnerUpgrade dtb-amazonUpgrade kernel-source-azureUpgrade kernel-default-develUpgrade kernel-macrosUpgrade reiserfs-kmp-64kbUpgrade kernel-azure-optionalUpgrade kernel-rt_debugUpgrade dtb-apmUpgrade kernel-rt-optionalUpgrade dtb-exynosUpgrade kernel-default-livepatchUpgrade reiserfs-kmp-default | Dec 5, 2025 | Sep 12, 2024 |
| Ubuntu | — | Upgrade linux-image-raspiUpgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-40-genericUpgrade linux-image-6.8.0-1013-awsUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-kvmUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-gkeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-virtualUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oracleUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1012-azureUpgrade linux-image-awsUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-azure | Aug 9, 2024 | Jun 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Jun 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub