Linux Kernel Bridge STP Timer Use-After-Free Vulnerability

A serious use-after-free vulnerability was identified in the Linux kernel's software bridge implementation, specifically in how Spanning Tree Protocol timers are managed. When a bridge interface is administratively down but kernel STP remains enabled, and a port transitions into the LEARNING state, periodic STP timers get armed without any IFF_UP guard. These timers live inside the net_bridge structure, which itself is embedded in the private data of the bridge's net_device.

The flaw stems from an asymmetry between two teardown paths: the standard ndo_stop path properly cancels all STP timers via br_stp_disable_bridge(), but the dellink path used to delete a bridge link skips this step entirely. As a result, the net_device can be freed while a timer is still queued on a per-CPU timer base. When that timer eventually fires, the kernel dereferences freed slab memory in the kmalloc-cg-8k cache, and if an attacker can reclaim the slot with a controlled buffer, the timer's function pointer can be hijacked to achieve arbitrary control-flow execution.

The issue was independently reported by researchers n132 and sven sze during TyphoonPWN 2026, earning second place in the Linux privilege escalation category. A fix landed in the mainline kernel via commit 2a00517db8de, closing the gap by ensuring proper timer cancellation regardless of which teardown path is taken. Systems running affected kernel versions should be patched promptly.