CVE-2025-38248

A flaw was found in the Linux kernel's bridge multicast functionality. A local user could trigger a use-after-free vulnerability, a type of memory corruption, by improperly configuring network bridge router ports. This issue arises because the system fails to correctly remove ports from its internal router port lists, leading to references to freed memory. Exploiting this flaw could result in system instability, denial of service, or potentially allow for privilege escalation.

This Moderate impact use-after-free flaw in the Linux kernel's bridge multicast functionality affects Red Hat Enterprise Linux 8 and 9. A local attacker could exploit this vulnerability by improperly configuring network bridge router ports, leading to a kernel information leak, denial of service, or tcp protocol data breach. Red Hat Enterprise Linux 6 and 7 are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.