In the Linux kernel, the following vulnerability has been resolved:
net: bridge: mst: fix vlan use-after-free
syzbot reported a suspicious rcu usage[1] in bridge's mst code. While fixing it I noticed that nothing prevents a vlan to be freed while walking the list from the same path (br forward delay timer). Fix the rcu usage and also make sure we are not accessing freed memory by making br_mst_vlan_set_state use rcu read lock.
[1] WARNING: suspicious RCU usage 6.9.0-rc6-syzkaller #0 Not tainted ----------------------------- net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage! ... stack backtrace: CPU: 1 PID: 8017 Comm: syz-executor.1 Not tainted 6.9.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712 nbp_vlan_group net/bridge/br_private.h:1599 [inline] br_mst_set_state+0x1ea/0x650 net/bridge/br_mst.c:105 br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47 br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88 call_timer_fn+0x18e/0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1844 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2429 run_timer_base kernel/time/timer.c:2438 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448 __do_softirq+0x2c6/0x980 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5758 Code: 2b 00 74 08 4c 89 f7 e8 ba d1 84 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25 RSP: 0018:ffffc90013657100 EFLAGS: 00000206 RAX: 0000000000000001 RBX: 1ffff920026cae2c RCX: 0000000000000001 RDX: dffffc0000000000 RSI: ffffffff8bcaca00 RDI: ffffffff8c1eaa60 RBP: ffffc90013657260 R08: ffffffff92efe507 R09: 1ffffffff25dfca0 R10: dffffc0000000000 R11: fffffbfff25dfca1 R12: 1ffff920026cae28 R13: dffffc0000000000 R14: ffffc90013657160 R15: 0000000000000246
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-abi-stablelistsUpgrade rtlaUpgrade kernel-debug-develUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-develUpgrade kernel-modulesUpgrade kernel-tools-libs-develUpgrade kernel-64kUpgrade kernel-devel-matchedUpgrade kernel-cross-headersUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdumpUpgrade kernel-coreUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debugUpgrade kernel-64k-modulesUpgrade libperfUpgrade kernel-64k-debug-modules-extraUpgrade kernel-64k-modules-coreUpgrade kernel-64k-coreUpgrade kernel-uki-virtUpgrade kernel-headersUpgrade kernel-64k-debugUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-develUpgrade kernelUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-docUpgrade kernel-debug-coreUpgrade kernel-rtUpgrade rvUpgrade kernel-debug-uki-virtUpgrade python3-perfUpgrade perfUpgrade kernel-rt-debug-coreUpgrade kernel-64k-modules-extraUpgrade kernel-modules-extraUpgrade kernel-rt-coreUpgrade kernel-64k-debug-develUpgrade kernel-develUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-modulesUpgrade kernel-tools-libsUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-modules-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-develUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-develUpgrade kernel-rt-debugUpgrade kernel-toolsUpgrade kernel-rt-kvmUpgrade kernel-64k-debug-coreUpgrade bpftoolUpgrade kernel-rt-debug-modules | Aug 12, 2024 | Jun 19, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-headersUpgrade kernel-modules-extra-commonUpgrade kernel-develUpgrade perfUpgrade kernel-libbpf-staticUpgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-livepatch-6.1.94-99.176Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-extraUpgrade kernel-libbpf-develUpgrade kernel-libbpfUpgrade bpftool | Feb 17, 2025 | Jun 19, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 19, 2024 |
| Oracle_linux | — | Upgrade kernel | Aug 16, 2024 | Jun 19, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Aug 12, 2024 | Jun 19, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debugUpgrade kernel-rt-kvmUpgrade kernel-toolsUpgrade kernel-debug-debuginfoUpgrade kernel-modules-extraUpgrade python3-perfUpgrade kernel-tools-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-rt-coreUpgrade kernel-develUpgrade kernel-debug-coreUpgrade bpftoolUpgrade kernel-rt-modulesUpgrade kernel-rt-develUpgrade rvUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rtUpgrade kernel-rt-debug-debuginfoUpgrade perfUpgrade kernel-cross-headersUpgrade kernel-rt-debug-modules-extraUpgrade perf-debuginfoUpgrade kernel-rt-debug-develUpgrade kernel-debuginfoUpgrade kernel-debug-devel-matchedUpgrade kernel-debugUpgrade kernel-headersUpgrade kernel-uki-virtUpgrade kernel-modulesUpgrade kernel-devel-matchedUpgrade kernel-debug-modules-extraUpgrade libperf-debuginfoUpgrade rtlaUpgrade libperfUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-rt-modules-coreUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-debug-develUpgrade kernelUpgrade kernel-modules-coreUpgrade kernel-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-core | Aug 22, 2024 | Jun 19, 2024 |
| Suse | — | Upgrade kernel-azure-vdsoUpgrade kernel-default-base-rebuildUpgrade kernel-obs-buildUpgrade kernel-rt-extraUpgrade cluster-md-kmp-64kbUpgrade dtb-armUpgrade kernel-azure-develUpgrade kernel-default-livepatch-develUpgrade dlm-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-defaultUpgrade dlm-kmp-azureUpgrade kernel-rt-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade kernel-rtUpgrade kernel-rt-vdsoUpgrade kernel-devel-rtUpgrade dtb-rockchipUpgrade ocfs2-kmp-azureUpgrade kernel-default-baseUpgrade dtb-socionextUpgrade reiserfs-kmp-azureUpgrade dlm-kmp-defaultUpgrade dtb-sprdUpgrade kernel-docsUpgrade dtb-qcomUpgrade kernel-develUpgrade kernel-azureUpgrade kernel-rt_debug-vdsoUpgrade reiserfs-kmp-rtUpgrade dtb-xilinxUpgrade kernel-default-optionalUpgrade kernel-rt_debug-livepatch-develUpgrade cluster-md-kmp-rtUpgrade dtb-mediatekUpgrade kernel-debug-livepatch-develUpgrade kernel-debug-vdsoUpgrade kselftests-kmp-defaultUpgrade kernel-rt-develUpgrade dtb-nvidiaUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade kernel-syms-rtUpgrade kernel-sourceUpgrade dtb-alteraUpgrade kernel-rt-optionalUpgrade reiserfs-kmp-defaultUpgrade dtb-marvellUpgrade dtb-apmUpgrade dtb-appleUpgrade dlm-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-rt_debug-develUpgrade kernel-devel-azureUpgrade kernel-default-extraUpgrade kernel-debugUpgrade kernel-64kb-livepatch-develUpgrade dtb-amlogicUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-rtUpgrade kselftests-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-syms-azureUpgrade kernel-debug-develUpgrade dtb-broadcomUpgrade cluster-md-kmp-azureUpgrade kernel-azure-livepatch-develUpgrade dtb-amdUpgrade ocfs2-kmp-rtUpgrade gfs2-kmp-64kbUpgrade dtb-renesasUpgrade dtb-hisiliconUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-allwinnerUpgrade kernel-symsUpgrade kernel-azure-extraUpgrade ocfs2-kmp-64kbUpgrade kernel-default-vdsoUpgrade kernel-64kb-develUpgrade gfs2-kmp-azureUpgrade dtb-freescaleUpgrade ocfs2-kmp-defaultUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-obs-qaUpgrade kernel-docs-htmlUpgrade kernel-default-develUpgrade kernel-kvmsmallUpgrade kselftests-kmp-64kbUpgrade dtb-lgUpgrade kernel-source-vanillaUpgrade reiserfs-kmp-64kbUpgrade dtb-caviumUpgrade kernel-source-azureUpgrade kernel-macrosUpgrade kernel-azure-optionalUpgrade kernel-64kbUpgrade kernel-rt_debugUpgrade dtb-amazonUpgrade dtb-exynosUpgrade kernel-default-livepatch | Dec 5, 2025 | Sep 12, 2024 |
| Ubuntu | — | Upgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-oem-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-genericUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-gcpUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1010-oemUpgrade linux-image-virtualUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-nvidia | Aug 9, 2024 | Jun 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Jun 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub