CVE-2026-72389

A flaw was found in the Linux kernel's bridge Spanning Tree Protocol (STP) module. A missing check in the br_topology_change_detection() function allows a topology change timer to be armed while a bridge is administratively down. This can be exploited by an attacker to trigger a use-after-free vulnerability when the bridge is deleted, potentially leading to a denial of service or arbitrary code execution.

This vulnerability is assessed as having Moderate impact because triggering the condition requires local privileges such as CAP_NET_ADMIN or user namespace capabilities to create, manipulate, and delete network bridge interfaces. Typical Red Hat Enterprise Linux systems do not continuously instantiate and tear down network bridge devices, limiting everyday exposure. While a successful use-after-free can lead to a kernel crash or privilege escalation, exploitation depends on complex timing conditions during interface teardown.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.