CVE-2024-40920 (GCVE-0-2024-40920)

Vulnerability from cvelistv5 – Published: 2024-07-12 12:25 – Updated: 2026-08-05 11:34
VLAI
Title
net: bridge: mst: fix suspicious rcu usage in br_mst_set_state
Summary
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state I converted br_mst_set_state to RCU to avoid a vlan use-after-free but forgot to change the vlan group dereference helper. Switch to vlan group RCU deref helper to fix the suspicious rcu usage warning.
Severity
7.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8ca9a750fc711911ef616ceb627d07357b04545e , < caaa2129784a04dcade0ea92c12e6ff90bbd23d8 (git)
Affected: 4488617e5e995a09abe4d81add5fb165674edb59 , < 7caefa2771722e65496d85b62e1dc4442b7d1345 (git)
Affected: e43dd2b1ec746e105b7db5f9ad6ef14685a615a4 , < 406bfc04b01ee47e4c626f77ecc7d9f85135b166 (git)
Affected: 3a7c1661ae1383364cd6092d851f5e5da64d476b , < 546ceb1dfdac866648ec959cbc71d9525bd73462 (git)
Affected: a2b01e65d9ba8af2bb086d3b7288ca53a07249ac (git)
Affected: 6.8.12 , < 6.9 (semver)
Create a notification for this product.
Linux Linux Affected: 6.1.93 , < 6.1.95 (semver)
Affected: 6.6.33 , < 6.6.35 (semver)
Affected: 6.9.3 , < 6.9.6 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:57:50.802Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40920",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:05:33.673278Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:03.619Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_mst.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "caaa2129784a04dcade0ea92c12e6ff90bbd23d8",
              "status": "affected",
              "version": "8ca9a750fc711911ef616ceb627d07357b04545e",
              "versionType": "git"
            },
            {
              "lessThan": "7caefa2771722e65496d85b62e1dc4442b7d1345",
              "status": "affected",
              "version": "4488617e5e995a09abe4d81add5fb165674edb59",
              "versionType": "git"
            },
            {
              "lessThan": "406bfc04b01ee47e4c626f77ecc7d9f85135b166",
              "status": "affected",
              "version": "e43dd2b1ec746e105b7db5f9ad6ef14685a615a4",
              "versionType": "git"
            },
            {
              "lessThan": "546ceb1dfdac866648ec959cbc71d9525bd73462",
              "status": "affected",
              "version": "3a7c1661ae1383364cd6092d851f5e5da64d476b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a2b01e65d9ba8af2bb086d3b7288ca53a07249ac",
              "versionType": "git"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.12",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_mst.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.1.95",
              "status": "affected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.35",
              "status": "affected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9.6",
              "status": "affected",
              "version": "6.9.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.95",
                  "versionStartIncluding": "6.1.93",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.35",
                  "versionStartIncluding": "6.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.6",
                  "versionStartIncluding": "6.9.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mst: fix suspicious rcu usage in br_mst_set_state\n\nI converted br_mst_set_state to RCU to avoid a vlan use-after-free\nbut forgot to change the vlan group dereference helper. Switch to vlan\ngroup RCU deref helper to fix the suspicious rcu usage warning."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The buggy dereference is reached from the STP BPDU receive path (`br_stp_rcv` \u2192 `br_port_state_selection` \u2192 `br_set_state` \u2192 `br_mst_set_state`), so an attacker on the same L2 segment can drive port state transitions into it; STP BPDUs use the link-local `01:80:C2:00:00:00` LLC group address and are not routable, so this is adjacent rather than network.\nAC:L - On an MST-enabled bridge running kernel STP the unannotated dereference is hit deterministically on every port state transition, and the attacker drives both sides \u2014 flapping BPDUs force repeated transitions while port add/remove concurrently republishes `p-\u003evlgrp` \u2014 with no timing window or memory layout that must be won.\nPR:N - STP BPDU processing in `br_stp_rcv()` has no authentication whatsoever \u2014 a frame from the segment is accepted on any non-disabled, non-BPDU-guarded port \u2014 so the adjacent attacker needs no credentials on the target host.\nUI:N - Port state transitions occur automatically from received BPDUs and from the forward-delay timer; no administrator or user action is needed once the bridge is in MST mode.\nS:U - The faulty dereference, the resulting fault, and the log disclosure are all confined to the kernel that owns the bridge; no VM, IOMMU, or sandbox boundary is crossed.\nC:L - The `lockdep_rcu_suspicious()` report dumps a full kernel backtrace with raw stack and register addresses (as seen in the syzbot trace) into the kernel log, disclosing text and stack layout useful for defeating KASLR; there is no bulk or arbitrary memory read.\nI:N - The defect is a read-side annotation mismatch \u2014 no attacker-controlled data is written and no out-of-bounds or freed memory is modified, so no write or control-flow-hijack primitive results.\nA:H - Without the RCU dereference the load of `p-\u003evlgrp` carries no `READ_ONCE()` or dependency ordering, so a softirq reader racing a concurrent `nbp_vlan_flush()`/`nbp_vlan_init()` can traverse `vg-\u003evlan_list` and write `vg-\u003epvid_state` on a NULL or not-yet-published group, oopsing the kernel and taking down the bridging host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:00.976Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345"
        },
        {
          "url": "https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166"
        },
        {
          "url": "https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462"
        }
      ],
      "title": "net: bridge: mst: fix suspicious rcu usage in br_mst_set_state",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40920",
    "datePublished": "2024-07-12T12:25:02.222Z",
    "dateReserved": "2024-07-12T12:17:45.582Z",
    "dateUpdated": "2026-08-05T11:34:00.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-40920",
      "date": "2026-08-05",
      "epss": "0.00417",
      "percentile": "0.34328"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-40920\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:15.003\",\"lastModified\":\"2026-06-17T07:46:52.387\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: bridge: mst: fix suspicious rcu usage in br_mst_set_state\\n\\nI converted br_mst_set_state to RCU to avoid a vlan use-after-free\\nbut forgot to change the vlan group dereference helper. Switch to vlan\\ngroup RCU deref helper to fix the suspicious rcu usage warning.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: net: bridge: mst: corrige el uso sospechoso de rcu en br_mst_set_state Convert\u00ed br_mst_set_state a RCU para evitar un use-after-free de VLAN, pero olvid\u00e9 cambiar el asistente de desreferencia del grupo VLAN. Cambie al asistente deref de RCU del grupo vlan para corregir la advertencia de uso sospechoso de rcu.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bridge/br_mst.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8ca9a750fc711911ef616ceb627d07357b04545e\",\"lessThan\":\"caaa2129784a04dcade0ea92c12e6ff90bbd23d8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4488617e5e995a09abe4d81add5fb165674edb59\",\"lessThan\":\"7caefa2771722e65496d85b62e1dc4442b7d1345\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e43dd2b1ec746e105b7db5f9ad6ef14685a615a4\",\"lessThan\":\"406bfc04b01ee47e4c626f77ecc7d9f85135b166\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3a7c1661ae1383364cd6092d851f5e5da64d476b\",\"lessThan\":\"546ceb1dfdac866648ec959cbc71d9525bd73462\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a2b01e65d9ba8af2bb086d3b7288ca53a07249ac\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.8.12\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bridge/br_mst.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.1.93\",\"lessThan\":\"6.1.95\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.33\",\"lessThan\":\"6.6.35\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.9.3\",\"lessThan\":\"6.9.6\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:05:33.673278Z\",\"id\":\"CVE-2024-40920\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.93\",\"versionEndExcluding\":\"6.1.95\",\"matchCriteriaId\":\"12D7386D-25E8-40A5-B960-F1289E3EB949\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.33\",\"versionEndExcluding\":\"6.6.35\",\"matchCriteriaId\":\"AB52DAFF-C60A-4A6B-AF37-0991CBCE7C93\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8.12\",\"versionEndExcluding\":\"6.9\",\"matchCriteriaId\":\"A2D25EF8-8B93-4187-9555-F83C6F1ECA47\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9.3\",\"versionEndExcluding\":\"6.9.6\",\"matchCriteriaId\":\"B88D7AAA-B04F-4917-8190-1583726FE2B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3173713D-909A-4DD3-9DD4-1E171EB057EE\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:48:20+00:00",
      "cve": "CVE-2024-40920",
      "id": "CVE-2024-40920",
      "initial_release_date": "2024-07-12T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-40920.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T21:57:50.802Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40920\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:05:33.673278Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:14.304Z\"}}], \"cna\": {\"title\": \"net: bridge: mst: fix suspicious rcu usage in br_mst_set_state\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8ca9a750fc711911ef616ceb627d07357b04545e\", \"lessThan\": \"caaa2129784a04dcade0ea92c12e6ff90bbd23d8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4488617e5e995a09abe4d81add5fb165674edb59\", \"lessThan\": \"7caefa2771722e65496d85b62e1dc4442b7d1345\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e43dd2b1ec746e105b7db5f9ad6ef14685a615a4\", \"lessThan\": \"406bfc04b01ee47e4c626f77ecc7d9f85135b166\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3a7c1661ae1383364cd6092d851f5e5da64d476b\", \"lessThan\": \"546ceb1dfdac866648ec959cbc71d9525bd73462\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a2b01e65d9ba8af2bb086d3b7288ca53a07249ac\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6.8.12\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/bridge/br_mst.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.1.93\", \"lessThan\": \"6.1.95\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.6.33\", \"lessThan\": \"6.6.35\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.9.3\", \"lessThan\": \"6.9.6\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/bridge/br_mst.c\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8\"}, {\"url\": \"https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345\"}, {\"url\": \"https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166\"}, {\"url\": \"https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: bridge: mst: fix suspicious rcu usage in br_mst_set_state\\n\\nI converted br_mst_set_state to RCU to avoid a vlan use-after-free\\nbut forgot to change the vlan group dereference helper. Switch to vlan\\ngroup RCU deref helper to fix the suspicious rcu usage warning.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.95\", \"versionStartIncluding\": \"6.1.93\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.35\", \"versionStartIncluding\": \"6.6.33\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.6\", \"versionStartIncluding\": \"6.9.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.8.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:51:02.195Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40920\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:51:02.195Z\", \"dateReserved\": \"2024-07-12T12:17:45.582Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:25:02.222Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.