CVE-2025-40297

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40297", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.185Z", "datePublished": "2025-12-08T00:46:21.112Z", "dateUpdated": "2026-10-15T22:02:42.947Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:09:19.467Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix use-after-free due to MST port state bypass\n\nsyzbot reported[1] a use-after-free when deleting an expired fdb. It is\ndue to a race condition between learning still happening and a port being\ndeleted, after all its fdbs have been flushed. The port's state has been\ntoggled to disabled so no learning should happen at that time, but if we\nhave MST enabled, it will bypass the port's state, that together with VLAN\nfiltering disabled can lead to fdb learning at a time when it shouldn't\nhappen while the port is being deleted. VLAN filtering must be disabled\nbecause we flush the port VLANs when it's being deleted which will stop\nlearning. This fix adds a check for the port's vlan group which is\ninitialized to NULL when the port is getting deleted, that avoids the port\nstate bypass. When MST is enabled there would be a minimal new overhead\nin the fast-path because the port's vlan group pointer is cache-hot.\n\n[1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Triggering the race requires locally issuing rtnetlink commands (create bridge, enable MST via IFLA_BRIDGE_MST, detach the port with RTM_SETLINK) concurrently with frame injection; the port-deletion half of the race cannot be driven by a remote peer.\nAC:L - The attacker controls both sides of the race \u2014 the packet flood on the veth peer and the timing of the port deletion \u2014 and the window spans the whole post-flush tail of del_nbp() (switchdev deferred processing, netdev_upper_dev_unlink notifiers, rx_handler unregister), so it is wide and can be retried in a loop.\nPR:L - All required operations are CAP_NET_ADMIN/CAP_NET_RAW rtnetlink and AF_PACKET calls gated by netlink_net_capable(), which an unprivileged user obtains over their own network namespace via unshare -Urn; no real root in the init namespace is needed.\nUI:N - The attacker performs the bridge setup, traffic generation, and port deletion entirely on their own; no victim action is involved.\nS:U - The use-after-free corrupts kernel memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale fdb->dst is read after the net_bridge_port slab is freed and can be reclaimed with attacker-sprayed data, and fdb_fill_info() leaks dst->dev->ifindex from that attacker-chosen address into an RTM_DELNEIGH netlink broadcast readable from userspace \u2014 an arbitrary kernel read primitive.\nI:H - The surviving fdb entry stays in the hash table and is used for forwarding, so br_forward(dst->dst, ...) dereferences the freed port's ->dev and reaches dev_queue_xmit(), giving an indirect call through function pointers read from the reclaimed slab \u2014 a control-flow hijack primitive.\nA:H - Even without grooming, dereferencing the freed net_bridge_port during fdb expiry or forwarding oopses the kernel; this is the use-after-free syzbot originally reported."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bridge/br_forward.c", "net/bridge/br_input.c", "net/bridge/br_private.h"], "versions": [{"version": "ec7328b59176227216c461601c6bd0e922232a9b", "lessThan": "e19085b2a86addccff33ab8536fc67ebd9d52198", "status": "affected", "versionType": "git"}, {"version": "ec7328b59176227216c461601c6bd0e922232a9b", "lessThan": "3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8", "status": "affected", "versionType": "git"}, {"version": "ec7328b59176227216c461601c6bd0e922232a9b", "lessThan": "bf3843183bc3158e5821b46f330c438ae9bd6ddb", "status": "affected", "versionType": "git"}, {"version": "ec7328b59176227216c461601c6bd0e922232a9b", "lessThan": "991fbe1680cd41a5f97c92cd3a3496315df36e4b", "status": "affected", "versionType": "git"}, {"version": "ec7328b59176227216c461601c6bd0e922232a9b", "lessThan": "8dca36978aa80bab9d4da130c211db75c9e00048", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bridge/br_forward.c", "net/bridge/br_input.c", "net/bridge/br_private.h"], "versions": [{"version": "5.18", "status": "affected"}, {"version": "0", "lessThan": "5.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.159", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.117", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.58", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.8", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.1.159"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.6.117"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.12.58"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.17.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e19085b2a86addccff33ab8536fc67ebd9d52198"}, {"url": "https://git.kernel.org/stable/c/3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8"}, {"url": "https://git.kernel.org/stable/c/bf3843183bc3158e5821b46f330c438ae9bd6ddb"}, {"url": "https://git.kernel.org/stable/c/991fbe1680cd41a5f97c92cd3a3496315df36e4b"}, {"url": "https://git.kernel.org/stable/c/8dca36978aa80bab9d4da130c211db75c9e00048"}], "title": "net: bridge: fix use-after-free due to MST port state bypass", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40297", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:58:53.558417Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:42.947Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40297", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:58:53.558417Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:58:54.495Z"}}], "cna": {"title": "net: bridge: fix use-after-free due to MST port state bypass", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Triggering the race requires locally issuing rtnetlink commands (create bridge, enable MST via IFLA_BRIDGE_MST, detach the port with RTM_SETLINK) concurrently with frame injection; the port-deletion half of the race cannot be driven by a remote peer.\nAC:L - The attacker controls both sides of the race \u2014 the packet flood on the veth peer and the timing of the port deletion \u2014 and the window spans the whole post-flush tail of del_nbp() (switchdev deferred processing, netdev_upper_dev_unlink notifiers, rx_handler unregister), so it is wide and can be retried in a loop.\nPR:L - All required operations are CAP_NET_ADMIN/CAP_NET_RAW rtnetlink and AF_PACKET calls gated by netlink_net_capable(), which an unprivileged user obtains over their own network namespace via unshare -Urn; no real root in the init namespace is needed.\nUI:N - The attacker performs the bridge setup, traffic generation, and port deletion entirely on their own; no victim action is involved.\nS:U - The use-after-free corrupts kernel memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale fdb->dst is read after the net_bridge_port slab is freed and can be reclaimed with attacker-sprayed data, and fdb_fill_info() leaks dst->dev->ifindex from that attacker-chosen address into an RTM_DELNEIGH netlink broadcast readable from userspace \u2014 an arbitrary kernel read primitive.\nI:H - The surviving fdb entry stays in the hash table and is used for forwarding, so br_forward(dst->dst, ...) dereferences the freed port's ->dev and reaches dev_queue_xmit(), giving an indirect call through function pointers read from the reclaimed slab \u2014 a control-flow hijack primitive.\nA:H - Even without grooming, dereferencing the freed net_bridge_port during fdb expiry or forwarding oopses the kernel; this is the use-after-free syzbot originally reported."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ec7328b59176227216c461601c6bd0e922232a9b", "lessThan": "e19085b2a86addccff33ab8536fc67ebd9d52198", "versionType": "git"}, {"status": "affected", "version": "ec7328b59176227216c461601c6bd0e922232a9b", "lessThan": "3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8", "versionType": "git"}, {"status": "affected", "version": "ec7328b59176227216c461601c6bd0e922232a9b", "lessThan": "bf3843183bc3158e5821b46f330c438ae9bd6ddb", "versionType": "git"}, {"status": "affected", "version": "ec7328b59176227216c461601c6bd0e922232a9b", "lessThan": "991fbe1680cd41a5f97c92cd3a3496315df36e4b", "versionType": "git"}, {"status": "affected", "version": "ec7328b59176227216c461601c6bd0e922232a9b", "lessThan": "8dca36978aa80bab9d4da130c211db75c9e00048", "versionType": "git"}], "programFiles": ["net/bridge/br_forward.c", "net/bridge/br_input.c", "net/bridge/br_private.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"status": "unaffected", "version": "0", "lessThan": "5.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.159", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.117", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.58", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.8", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bridge/br_forward.c", "net/bridge/br_input.c", "net/bridge/br_private.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e19085b2a86addccff33ab8536fc67ebd9d52198"}, {"url": "https://git.kernel.org/stable/c/3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8"}, {"url": "https://git.kernel.org/stable/c/bf3843183bc3158e5821b46f330c438ae9bd6ddb"}, {"url": "https://git.kernel.org/stable/c/991fbe1680cd41a5f97c92cd3a3496315df36e4b"}, {"url": "https://git.kernel.org/stable/c/8dca36978aa80bab9d4da130c211db75c9e00048"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix use-after-free due to MST port state bypass\n\nsyzbot reported[1] a use-after-free when deleting an expired fdb. It is\ndue to a race condition between learning still happening and a port being\ndeleted, after all its fdbs have been flushed. The port's state has been\ntoggled to disabled so no learning should happen at that time, but if we\nhave MST enabled, it will bypass the port's state, that together with VLAN\nfiltering disabled can lead to fdb learning at a time when it shouldn't\nhappen while the port is being deleted. VLAN filtering must be disabled\nbecause we flush the port VLANs when it's being deleted which will stop\nlearning. This fix adds a check for the port's vlan group which is\ninitialized to NULL when the port is getting deleted, that avoids the port\nstate bypass. When MST is enabled there would be a minimal new overhead\nin the fast-path because the port's vlan group pointer is cache-hot.\n\n[1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.159", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.117", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.58", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.8", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "5.18"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:09:19.467Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40297", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:42.947Z", "dateReserved": "2025-04-16T07:20:57.185Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-12-08T00:46:21.112Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bridge/br_forward.c", "net/bridge/br_input.c", "net/bridge/br_private.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e19085b2a86addccff33ab8536fc67ebd9d52198", "status": "affected", "version": "ec7328b59176227216c461601c6bd0e922232a9b", "versionType": "git"}, {"lessThan": "3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8", "status": "affected", "version": "ec7328b59176227216c461601c6bd0e922232a9b", "versionType": "git"}, {"lessThan": "bf3843183bc3158e5821b46f330c438ae9bd6ddb", "status": "affected", "version": "ec7328b59176227216c461601c6bd0e922232a9b", "versionType": "git"}, {"lessThan": "991fbe1680cd41a5f97c92cd3a3496315df36e4b", "status": "affected", "version": "ec7328b59176227216c461601c6bd0e922232a9b", "versionType": "git"}, {"lessThan": "8dca36978aa80bab9d4da130c211db75c9e00048", "status": "affected", "version": "ec7328b59176227216c461601c6bd0e922232a9b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bridge/br_forward.c", "net/bridge/br_input.c", "net/bridge/br_private.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"lessThan": "5.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.159", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.117", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.58", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix use-after-free due to MST port state bypass\n\nsyzbot reported[1] a use-after-free when deleting an expired fdb. It is\ndue to a race condition between learning still happening and a port being\ndeleted, after all its fdbs have been flushed. The port's state has been\ntoggled to disabled so no learning should happen at that time, but if we\nhave MST enabled, it will bypass the port's state, that together with VLAN\nfiltering disabled can lead to fdb learning at a time when it shouldn't\nhappen while the port is being deleted. VLAN filtering must be disabled\nbecause we flush the port VLANs when it's being deleted which will stop\nlearning. This fix adds a check for the port's vlan group which is\ninitialized to NULL when the port is getting deleted, that avoids the port\nstate bypass. When MST is enabled there would be a minimal new overhead\nin the fast-path because the port's vlan group pointer is cache-hot.\n\n[1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: bridge: correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n debido a un bypass del estado del puerto MST\n\nsyzbot inform\u00f3[1] un uso despu\u00e9s de liberaci\u00f3n al eliminar un fdb caducado. Se debe a una condici\u00f3n de carrera entre el aprendizaje que a\u00fan ocurre y la eliminaci\u00f3n de un puerto, despu\u00e9s de que todos sus fdbs hayan sido vaciados. El estado del puerto ha sido cambiado a deshabilitado por lo que no deber\u00eda ocurrir aprendizaje en ese momento, pero si tenemos MST habilitado, omitir\u00e1 el estado del puerto, lo que, junto con el filtrado de VLAN deshabilitado, puede llevar al aprendizaje de fdb en un momento en que no deber\u00eda ocurrir mientras el puerto est\u00e1 siendo eliminado. El filtrado de VLAN debe estar deshabilitado porque vaciamos las VLAN del puerto cuando est\u00e1 siendo eliminado, lo que detendr\u00e1 el aprendizaje. Esta correcci\u00f3n a\u00f1ade una verificaci\u00f3n para el grupo de vlan del puerto que se inicializa a NULL cuando el puerto est\u00e1 siendo eliminado, lo que evita el bypass del estado del puerto. Cuando MST est\u00e1 habilitado, habr\u00eda una sobrecarga nueva m\u00ednima en la ruta r\u00e1pida porque el puntero del grupo de vlan del puerto est\u00e1 en cach\u00e9 caliente.\n\n[1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be"}], "id": "CVE-2025-40297", "lastModified": "2026-10-15T22:19:07.277", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40297", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:58:53.558417Z", "version": "2.0.3"}}]}, "published": "2025-12-08T01:16:01.813", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8dca36978aa80bab9d4da130c211db75c9e00048"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/991fbe1680cd41a5f97c92cd3a3496315df36e4b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bf3843183bc3158e5821b46f330c438ae9bd6ddb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e19085b2a86addccff33ab8536fc67ebd9d52198"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: net: bridge: fix use-after-free due to MST port state bypass", "id": "2419944", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419944"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40297", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40297\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40297\nhttps://lore.kernel.org/linux-cve-announce/2025120819-CVE-2025-40297-8d83@gregkh/T"], "threat_severity": "Moderate"}

{}