Loading story…
A newly disclosed Linux kernel vulnerability in the bridge subsystem's Spanning Tree Protocol (STP) implementation can trigger a use-after-free when STP timers are armed on an administratively down bridge and a port is forced into the LEARNING state without an IFF_UP guard. If the bridge device is then deleted, the teardown path can leave queued timers behind even after the backing net_device and embedded struct net_bridge memory have been freed, leading to memory corruption in the kmalloc-cg-8k slab cache.
A public proof-of-concept has now been released, increasing the risk of crashes and denial-of-service on affected systems and raising the possibility of further exploitation through controlled slab reallocation and potential control-flow hijacking. Researchers traced the bug to inconsistent cleanup between normal interface shutdown and direct bridge deletion in net/bridge, where the deletion path does not invoke the same STP timer cleanup routine; the issue was addressed in Linux kernel commit 2a00517db8de4be7df3d483b215c5544fb30a191, and systems running earlier kernels should be updated.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers released a public proof-of-concept demonstrating the Linux kernel bridge STP use-after-free bug and the affected object lifecycle. Reporting said the issue could cause crashes or denial of service and might potentially be developed into a control-flow hijacking primitive through controlled slab reallocation.
A patch for the bridge STP use-after-free vulnerability was introduced in Linux kernel commit 2a00517db8de4be7df3d483b215c5544fb30a191. The fix addresses the inconsistent cleanup path that could leave STP timers active after bridge deletion.
A new Linux kernel vulnerability was disclosed in the bridge subsystem's Spanning Tree Protocol implementation. The flaw is a use-after-free condition triggered when STP timers remain armed after a bridge device is deleted under specific down-state and LEARNING-state conditions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A flaw tracked as **CVE-2026-46086** in the Linux kernel's bridge networking component can let a low-privileged local attacker crash a system by triggering a race in forwarding database (FDB) handling. The bug stems from RCU readers loading the FDB destination pointer multiple times while concurrent updates can rewrite that pointer in place, allowing `br_fdb_fillbuf()` to pass a NULL check and later dereference a NULL pointer. Red Hat rated the issue **Moderate** with a **CVSS v3.1 score of 5.5**, classifying it as a **CWE-367** time-of-check time-of-use race condition with denial-of-service impact only. Upstream kernel maintainers fixed the issue by taking a stable snapshot of `f->dst` with `READ_ONCE()` in affected RCU readers and using `WRITE_ONCE()` for in-place updates in `fdb_delete_local()`. The vulnerability was introduced in kernel **3.14** and patched in stable releases including **6.6.140**, **6.12.86**, **6.18.27**, **7.0.4**, and **7.1-rc1**. Red Hat said fixes are available for **RHEL 8** `kernel` and `kernel-rt`, **RHEL 9** `kernel`, and **RHEL 10** `kernel`, while **RHEL 7** `kernel`, **RHEL 7 kernel-rt`, and **RHEL 9 kernel-rt** remain affected; **RHEL 6** is out of support and should be assumed vulnerable.
Aug 25, 2026
Two Linux kernel use-after-free vulnerabilities were disclosed in packet-filtering components, exposing systems to local privilege escalation. **CVE-2026-23111** affects the `nftables` subsystem and stems from an inverted conditional in `nft_map_catchall_activate()` that mishandles catchall elements during transaction aborts, leaving a dangling chain reference. A public technical write-up and working exploit showed the bug can achieve root privileges with high reliability on Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS by corrupting chain reference counts, bypassing KASLR, leaking heap addresses, hijacking control flow with a fake `nft_expr_ops` structure, and executing a ROP chain that calls `commit_creds(&init_cred)`. The exploit also uses `switch_task_namespaces()` to break out of namespaces and containers. A separate flaw, **CVE-2026-23412**, affects the Linux kernel’s BPF netfilter link implementation in `nf_bpf_link.c`, where synchronous deallocation of `bpf_nf_link_lops` allowed concurrent `nfnetlink` hook enumeration to access freed memory during BPF link destruction. Researchers reproduced KASAN slab-use-after-free crashes in `nfnl_hook_dump_one` on kernel `6.14.0` and said the bug could be exploited through heap spraying and function-pointer hijacking in the `kmalloc-192` slab cache. The issue was introduced in `6.4-rc1` and fixed in `7.0-rc5` by commit `24f90fa3994b`, which switches to RCU-deferred freeing, while the `nftables` bug was patched upstream by commit `f41c5d1`; administrators were urged to deploy patched kernels promptly.
Jun 29, 2026
**CVE-2024-26804** is a use-after-free flaw in the Linux kernel's IPv4 `ip_tunnel` infrastructure that allows a low-privileged local user to crash an affected system. Recursive GRE or IPIP tunnel routing can cause a tunnel device's `needed_headroom` to increase indefinitely; after the packet buffer headroom exceeds 64 KiB, the 16-bit `skb->network_header` field can wrap, resulting in an out-of-bounds packet-buffer adjustment and use-after-free condition. The issue has existed since kernel version 2.6.34 and is fixed in stable releases 5.4.271, 5.10.212, 5.15.151, 6.1.81, 6.6.21, 6.7.9, and 6.8 or later. Red Hat rates the issue as moderate severity with CVSS 5.5 and has issued updates for affected RHEL 8 and 9 streams; RHEL 6 is unsupported and should be considered affected. Organizations should deploy vendor kernel updates or move to a current stable kernel release rather than cherry-picking the individual patch.
Aug 26, 2026