Skip to main content

Linux Kernel CVE-2025-40297

| EUVDEUVD-2025-201647 HIGH
2025-12-08 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Authentication Bypass Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local-only race in bridge port teardown requires CAP_NET_ADMIN (PR:L) and winning a narrow timing window (AC:H); UAF yields full memory-corruption impact (C/I/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Patch released
Mar 25, 2026 - 19:32 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 17:54 euvd
EUVD-2025-201647
Analysis Generated
Mar 15, 2026 - 17:54 vuln.today
CVE Published
Dec 08, 2025 - 01:16 cve.org
HIGH 7.8
CVE Published
Dec 08, 2025 - 01:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: fix use-after-free due to MST port state bypass

syzbot reported[1] a use-after-free when deleting an expired fdb. It is due to a race condition between learning still happening and a port being deleted, after all its fdbs have been flushed. The port's state has been toggled to disabled so no learning should happen at that time, but if we have MST enabled, it will bypass the port's state, that together with VLAN filtering disabled can lead to fdb learning at a time when it shouldn't happen while the port is being deleted. VLAN filtering must be disabled because we flush the port VLANs when it's being deleted which will stop learning. This fix adds a check for the port's vlan group which is initialized to NULL when the port is getting deleted, that avoids the port state bypass. When MST is enabled there would be a minimal new overhead in the fast-path because the port's vlan group pointer is cache-hot.

[1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be

AnalysisAI

Local privilege-level attackers can trigger a use-after-free in the Linux kernel's network bridge (net/bridge) MST implementation when a bridge port is deleted concurrently with FDB learning. The flaw stems from Multiple Spanning Tree (MST) mode bypassing the port's disabled state check, allowing FDB entries to be learned while a port is being torn down. EPSS is low (0.04%, 11th percentile) and there is no public exploit identified at time of analysis; the issue was found by syzbot fuzzing rather than in-the-wild exploitation.

Technical ContextAI

The vulnerability lives in the Linux bridge forwarding subsystem, specifically the forwarding database (FDB) learning path interacting with MST (Multiple Spanning Tree, per-VLAN spanning-tree instances) port state handling. Normally a port toggled to the disabled state stops learning new FDB entries, but MST mode intentionally bypasses the generic port state to apply per-MST-instance state instead. Combined with VLAN filtering disabled (which is required because deleting a port flushes its VLANs and would otherwise halt learning), a race window opens where the port's FDBs have already been flushed and the port is mid-deletion, yet learning still adds an entry - leading to a use-after-free when an expired FDB is later deleted. This is a classic race-condition-induced use-after-free (CWE-416, though the feed reports CWE as N/A); the fix adds a NULL check on the port's VLAN group pointer (set to NULL during deletion) to re-close the state bypass, with negligible fast-path cost since the pointer is cache-hot.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.1.159, 6.6.117, 6.12.58, 6.17.8, or 6.18 (or later within each series) - using the appropriate stable commit from git.kernel.org (e.g., 3b60ce334c1c, e19085b2a862). Distribution users should apply their vendor update; Ubuntu ships the fix via USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1). As a compensating control on unpatched hosts, disable MST mode on the affected bridge (or enable VLAN filtering on the bridge, since the fix path and the race both depend on VLAN filtering being off) to avoid the port-state bypass - the trade-off is loss of per-VLAN spanning-tree behavior or a change in VLAN handling semantics, which must be validated against the network design. Restricting who can configure bridge ports (CAP_NET_ADMIN) further reduces exposure.

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-40297 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy