PoC Released for Linux Kernel STP Use-After-Free Vulnerability

A proof-of-concept (PoC) has been released for a use-after-free vulnerability affecting the Linux kernel’s software bridge implementation found in `net/bridge`.

This vulnerability occurs within the Spanning Tree Protocol (STP) timer lifecycle. It can result in timer structures referencing freed bridge memory, potentially allowing for control-flow hijacking.

The SSD Secure Disclosure technical team disclosed the issue following the TyphoonPWN 2026 competition, where independent researchers n132 and Sven Sze identified the problem and secured second place in the Linux privilege escalation category.

Linux has addressed this vulnerability by releasing a fix in commit `2a00517db8de4be7df3d483b215c5544fb30a191`.

STP Timer Lifetime Flaw

The Linux software bridge driver manages STP state through several periodic timers, including `hello_timer`, `tcn_timer`, `topology_change_timer`, and port-specific timers.

These timer structures are embedded within `struct net_bridge`, which is allocated in the private data portion of the bridge interface’s backing `net_device`.

This design makes the timer’s safety dependent on proper device teardown. If a bridge device is freed while one or more STP timers remain queued on a per-CPU timer base, a later timer execution could access memory that has already been returned to the slab allocator.

The vulnerability arises when kernel STP is enabled while the bridge interface is administratively down. An attacker or local user with the ability to manipulate bridge and port configurations can drive a bridge port into the LEARNING state, causing the STP code to activate periodic timers.

Critically, the affected timer-arming path does not verify that the bridge has the IFF_UP flag set, allowing timers to be scheduled even if the bridge interface itself is down.

The flaw originates from inconsistent cleanup behavior between the interface shutdown and deletion paths.

When a bridge transitions from UP to DOWN, the standard `ndo_stop` route triggers `br_dev_stop()`, followed by `br_stp_disable_bridge()`.

This cleanup function synchronously deletes STP timers using `del_timer_sync()`, preventing callbacks from running after the bridge memory has been freed.

However, directly deleting an already-down bridge follows the `dellink` path through `br_dev_delete()`, which does not call `br_stp_disable_bridge()`.

Additionally, `unregister_netdevice_many()` does not invoke `ndo_stop` for interfaces that are already down. Consequently, a bridge configured with STP enabled, with a port in the LEARNING state, could be deleted while its timers remain active.

The underlying `net_device` is then freed, leaving queued timer entries pointing to freed `kmalloc-cg-8k` slab memory.

Later, when the per-CPU timer base executes `__run_timers()` in softirq context, the kernel may trigger a dangling timer callback through `call_timer_fn()`.

The disclosed analysis indicates that reclaiming the freed object with attacker-controlled data could enable the replacement of the timer function pointer, transforming this issue into a potential kernel control-flow hijacking primitive.

Administrators and distributions should apply the upstream patch or update to kernel builds containing commit `2a00517db8de4be7df3d483b215c5544fb30a191`.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world