CVE-2024-40920

HIGH

Linux Kernel - Use-After-Free in Bridge MST State Handling

Title source: llm

Description

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state I converted br_mst_set_state to RCU to avoid a vlan use-after-free but forgot to change the vlan group dereference helper. Switch to vlan group RCU deref helper to fix the suspicious rcu usage warning.

References (5)

Core 5

Core References

Mailing List

https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Patch

https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8

Patch

https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345

Patch

https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166

Patch

https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462

Scores

CVSS v3 7.8

EPSS 0.0029

EPSS Percentile 20.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-416

Status published

Products (11)

Linux/Linux 3a7c1661ae1383364cd6092d851f5e5da64d476b - 546ceb1dfdac866648ec959cbc71d9525bd73462

Linux/Linux 4488617e5e995a09abe4d81add5fb165674edb59 - 7caefa2771722e65496d85b62e1dc4442b7d1345

Linux/Linux 6.1.93 - 6.1.95

Linux/Linux 6.6.33 - 6.6.35

Linux/Linux 6.8.12 - 6.9

Linux/Linux 6.9.3 - 6.9.6

Linux/Linux 8ca9a750fc711911ef616ceb627d07357b04545e - caaa2129784a04dcade0ea92c12e6ff90bbd23d8

Linux/Linux a2b01e65d9ba8af2bb086d3b7288ca53a07249ac

Linux/Linux e43dd2b1ec746e105b7db5f9ad6ef14685a615a4 - 406bfc04b01ee47e4c626f77ecc7d9f85135b166

linux/linux_kernel 6.10 rc1 (3 CPE variants)

... and 1 more

Published Jul 12, 2024

Tracked Since Feb 18, 2026