CVE-2025-40297

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a use-after-free issue within the networking bridge component. This flaw arises from a race condition during the deletion of a forwarding database (fdb) entry, specifically when Multiple Spanning Tree (MST) is enabled and VLAN filtering is disabled. The issue occurs because MST can bypass a port's disabled state, allowing fdb learning to occur while the port is being deleted, leading to a use-after-free condition. The fix introduces a check for the port's VLAN group, which is set to NULL during deletion, to prevent the state bypass.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.