CVE-2025-40297

A use-after-free was found in the Linux bridge networking code. When MST (Multiple Spanning Tree) is enabled and VLAN filtering is disabled, FDB learning can bypass the port state check during port deletion. This allows learning to occur on a port being deleted, leading to use-after-free when accessing freed FDB entries.

Exploitation requires a bridge configuration with MST enabled and VLAN filtering disabled, combined with specific timing during port deletion. Standard bridge configurations are less likely to be affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.