New Linux Bridge STP Vulnerability

Reddit •/u/SSDisclosure • August 5, 2026

A use-after-free vulnerability in the Linux kernel bridge (net/bridge) Spanning Tree Protocol (STP) implementation. A bridge that is administratively down while kernel STP is enabled, together with a port driven into the LEARNING state, arms periodic STP timers without an IFF_UP guard. The teardown path taken by dellink never synchronously deletes those timers, so the backing net_device (which embeds struct net bridge as private data) is freed with a timer list still queued on a per-CPU timer base. The result is a slab use-after-free in the kmalloc-cg-8k cache. submitted by /u/SSDisclosure [link] [ ]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Use-After-Free Vulnerability in Linux Kernel STP Disclosed A use-after-free vulnerability has been identified in the Linux kernel's bridge implementation affecting the Spanning Tree Protocol (STP). This flaw allows for timer structures to reference freed memory, potentially enabling control-flow hijacking. The vulnerability arises when a bridge is administratively down while STP is enabled, leading to a situation where timers are not properly deleted. A proof-of-concept (PoC) has been released, increasing the risk of exploitation. The issue affects systems using the Linux kernel's network bridge functionality. Security teams are urged to assess their environments for potential exposure. The vulnerability has not been assigned a CVE number yet, but it is considered critical due to the PoC availability. 2 sources 70

Extracted Entities

New Linux Bridge STP Vulnerability

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)