CVE-2025-40297 (GCVE-0-2025-40297)

Vulnerability from cvelistv5 – Published: 2025-12-08 00:46 – Updated: 2026-10-15 22:02
VLAI
Title
net: bridge: fix use-after-free due to MST port state bypass
Summary
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix use-after-free due to MST port state bypass syzbot reported[1] a use-after-free when deleting an expired fdb. It is due to a race condition between learning still happening and a port being deleted, after all its fdbs have been flushed. The port's state has been toggled to disabled so no learning should happen at that time, but if we have MST enabled, it will bypass the port's state, that together with VLAN filtering disabled can lead to fdb learning at a time when it shouldn't happen while the port is being deleted. VLAN filtering must be disabled because we flush the port VLANs when it's being deleted which will stop learning. This fix adds a check for the port's vlan group which is initialized to NULL when the port is getting deleted, that avoids the port state bypass. When MST is enabled there would be a minimal new overhead in the fast-path because the port's vlan group pointer is cache-hot. [1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 21:58 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6843 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ec7328b59176227216c461601c6bd0e922232a9b , < e19085b2a86addccff33ab8536fc67ebd9d52198 (git)
Affected: ec7328b59176227216c461601c6bd0e922232a9b , < 3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8 (git)
Affected: ec7328b59176227216c461601c6bd0e922232a9b , < bf3843183bc3158e5821b46f330c438ae9bd6ddb (git)
Affected: ec7328b59176227216c461601c6bd0e922232a9b , < 991fbe1680cd41a5f97c92cd3a3496315df36e4b (git)
Affected: ec7328b59176227216c461601c6bd0e922232a9b , < 8dca36978aa80bab9d4da130c211db75c9e00048 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.159 , ≤ 6.1.* (semver)
Unaffected: 6.6.117 , ≤ 6.6.* (semver)
Unaffected: 6.12.58 , ≤ 6.12.* (semver)
Unaffected: 6.17.8 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-40297",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:58:53.558417Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T22:02:42.947Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_forward.c",
            "net/bridge/br_input.c",
            "net/bridge/br_private.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e19085b2a86addccff33ab8536fc67ebd9d52198",
              "status": "affected",
              "version": "ec7328b59176227216c461601c6bd0e922232a9b",
              "versionType": "git"
            },
            {
              "lessThan": "3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8",
              "status": "affected",
              "version": "ec7328b59176227216c461601c6bd0e922232a9b",
              "versionType": "git"
            },
            {
              "lessThan": "bf3843183bc3158e5821b46f330c438ae9bd6ddb",
              "status": "affected",
              "version": "ec7328b59176227216c461601c6bd0e922232a9b",
              "versionType": "git"
            },
            {
              "lessThan": "991fbe1680cd41a5f97c92cd3a3496315df36e4b",
              "status": "affected",
              "version": "ec7328b59176227216c461601c6bd0e922232a9b",
              "versionType": "git"
            },
            {
              "lessThan": "8dca36978aa80bab9d4da130c211db75c9e00048",
              "status": "affected",
              "version": "ec7328b59176227216c461601c6bd0e922232a9b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_forward.c",
            "net/bridge/br_input.c",
            "net/bridge/br_private.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.117",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.58",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix use-after-free due to MST port state bypass\n\nsyzbot reported[1] a use-after-free when deleting an expired fdb. It is\ndue to a race condition between learning still happening and a port being\ndeleted, after all its fdbs have been flushed. The port\u0027s state has been\ntoggled to disabled so no learning should happen at that time, but if we\nhave MST enabled, it will bypass the port\u0027s state, that together with VLAN\nfiltering disabled can lead to fdb learning at a time when it shouldn\u0027t\nhappen while the port is being deleted. VLAN filtering must be disabled\nbecause we flush the port VLANs when it\u0027s being deleted which will stop\nlearning. This fix adds a check for the port\u0027s vlan group which is\ninitialized to NULL when the port is getting deleted, that avoids the port\nstate bypass. When MST is enabled there would be a minimal new overhead\nin the fast-path because the port\u0027s vlan group pointer is cache-hot.\n\n[1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggering the race requires locally issuing rtnetlink commands (create bridge, enable MST via IFLA_BRIDGE_MST, detach the port with RTM_SETLINK) concurrently with frame injection; the port-deletion half of the race cannot be driven by a remote peer.\nAC:L - The attacker controls both sides of the race \u2014 the packet flood on the veth peer and the timing of the port deletion \u2014 and the window spans the whole post-flush tail of del_nbp() (switchdev deferred processing, netdev_upper_dev_unlink notifiers, rx_handler unregister), so it is wide and can be retried in a loop.\nPR:L - All required operations are CAP_NET_ADMIN/CAP_NET_RAW rtnetlink and AF_PACKET calls gated by netlink_net_capable(), which an unprivileged user obtains over their own network namespace via unshare -Urn; no real root in the init namespace is needed.\nUI:N - The attacker performs the bridge setup, traffic generation, and port deletion entirely on their own; no victim action is involved.\nS:U - The use-after-free corrupts kernel memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale fdb-\u003edst is read after the net_bridge_port slab is freed and can be reclaimed with attacker-sprayed data, and fdb_fill_info() leaks dst-\u003edev-\u003eifindex from that attacker-chosen address into an RTM_DELNEIGH netlink broadcast readable from userspace \u2014 an arbitrary kernel read primitive.\nI:H - The surviving fdb entry stays in the hash table and is used for forwarding, so br_forward(dst-\u003edst, ...) dereferences the freed port\u0027s -\u003edev and reaches dev_queue_xmit(), giving an indirect call through function pointers read from the reclaimed slab \u2014 a control-flow hijack primitive.\nA:H - Even without grooming, dereferencing the freed net_bridge_port during fdb expiry or forwarding oopses the kernel; this is the use-after-free syzbot originally reported."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:19.467Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e19085b2a86addccff33ab8536fc67ebd9d52198"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf3843183bc3158e5821b46f330c438ae9bd6ddb"
        },
        {
          "url": "https://git.kernel.org/stable/c/991fbe1680cd41a5f97c92cd3a3496315df36e4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/8dca36978aa80bab9d4da130c211db75c9e00048"
        }
      ],
      "title": "net: bridge: fix use-after-free due to MST port state bypass",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40297",
    "datePublished": "2025-12-08T00:46:21.112Z",
    "dateReserved": "2025-04-16T07:20:57.185Z",
    "dateUpdated": "2026-10-15T22:02:42.947Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40297",
      "date": "2026-10-22",
      "epss": "0.00157",
      "percentile": "0.04489"
    },
    "microsoft_vex": {
      "current_release_date": "2025-12-16T14:39:49.000Z",
      "cve": "CVE-2025-40297",
      "id": "msrc_CVE-2025-40297",
      "initial_release_date": "2025-12-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: bridge: fix use-after-free due to MST port state bypass",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40297.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/bridge/br_forward.c",
                  "net/bridge/br_input.c",
                  "net/bridge/br_private.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "e19085b2a86addccff33ab8536fc67ebd9d52198",
                    "status": "affected",
                    "version": "ec7328b59176227216c461601c6bd0e922232a9b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8",
                    "status": "affected",
                    "version": "ec7328b59176227216c461601c6bd0e922232a9b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bf3843183bc3158e5821b46f330c438ae9bd6ddb",
                    "status": "affected",
                    "version": "ec7328b59176227216c461601c6bd0e922232a9b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "991fbe1680cd41a5f97c92cd3a3496315df36e4b",
                    "status": "affected",
                    "version": "ec7328b59176227216c461601c6bd0e922232a9b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8dca36978aa80bab9d4da130c211db75c9e00048",
                    "status": "affected",
                    "version": "ec7328b59176227216c461601c6bd0e922232a9b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/bridge/br_forward.c",
                  "net/bridge/br_input.c",
                  "net/bridge/br_private.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.18"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.159",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.117",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.58",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix use-after-free due to MST port state bypass\n\nsyzbot reported[1] a use-after-free when deleting an expired fdb. It is\ndue to a race condition between learning still happening and a port being\ndeleted, after all its fdbs have been flushed. The port\u0027s state has been\ntoggled to disabled so no learning should happen at that time, but if we\nhave MST enabled, it will bypass the port\u0027s state, that together with VLAN\nfiltering disabled can lead to fdb learning at a time when it shouldn\u0027t\nhappen while the port is being deleted. VLAN filtering must be disabled\nbecause we flush the port VLANs when it\u0027s being deleted which will stop\nlearning. This fix adds a check for the port\u0027s vlan group which is\ninitialized to NULL when the port is getting deleted, that avoids the port\nstate bypass. When MST is enabled there would be a minimal new overhead\nin the fast-path because the port\u0027s vlan group pointer is cache-hot.\n\n[1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: bridge: correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n debido a un bypass del estado del puerto MST\n\nsyzbot inform\u00f3[1] un uso despu\u00e9s de liberaci\u00f3n al eliminar un fdb caducado. Se debe a una condici\u00f3n de carrera entre el aprendizaje que a\u00fan ocurre y la eliminaci\u00f3n de un puerto, despu\u00e9s de que todos sus fdbs hayan sido vaciados. El estado del puerto ha sido cambiado a deshabilitado por lo que no deber\u00eda ocurrir aprendizaje en ese momento, pero si tenemos MST habilitado, omitir\u00e1 el estado del puerto, lo que, junto con el filtrado de VLAN deshabilitado, puede llevar al aprendizaje de fdb en un momento en que no deber\u00eda ocurrir mientras el puerto est\u00e1 siendo eliminado. El filtrado de VLAN debe estar deshabilitado porque vaciamos las VLAN del puerto cuando est\u00e1 siendo eliminado, lo que detendr\u00e1 el aprendizaje. Esta correcci\u00f3n a\u00f1ade una verificaci\u00f3n para el grupo de vlan del puerto que se inicializa a NULL cuando el puerto est\u00e1 siendo eliminado, lo que evita el bypass del estado del puerto. Cuando MST est\u00e1 habilitado, habr\u00eda una sobrecarga nueva m\u00ednima en la ruta r\u00e1pida porque el puntero del grupo de vlan del puerto est\u00e1 en cach\u00e9 caliente.\n\n[1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be"
          }
        ],
        "id": "CVE-2025-40297",
        "lastModified": "2026-10-15T22:19:07.277",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-40297",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:58:53.558417Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-12-08T01:16:01.813",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8dca36978aa80bab9d4da130c211db75c9e00048"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/991fbe1680cd41a5f97c92cd3a3496315df36e4b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bf3843183bc3158e5821b46f330c438ae9bd6ddb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e19085b2a86addccff33ab8536fc67ebd9d52198"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:38:37+00:00",
      "cve": "CVE-2025-40297",
      "id": "CVE-2025-40297",
      "initial_release_date": "2025-12-08T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: bridge: fix use-after-free due to MST port state bypass",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40297.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.