CVE-2026-72389

Received Received - Intake

Use-After-Free in Linux Kernel Bridge STP

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bridge: stp: Fix a potential use-after-free when deleting a bridge The three STP timers are not supposed to be armed while the bridge is administratively down. They are synchronously deactivated when the bridge is put administratively down and the various call sites check for 'IFF_UP' before arming them. This check is missing from br_topology_change_detection() and it is possible to engineer a situation in which the topology change timer is armed while the bridge is administratively down, resulting in a use-after-free [1] when the bridge is deleted. Fix by adding the missing check and for good measures synchronously shutdown the three timers when the bridge is deleted. [1] ODEBUG: free active (active state 0) object: ffff88811662b9b0 object type: timer_list hint: br_topology_change_timer_expired (net/bridge/br_stp_timer.c:120) WARNING: lib/debugobjects.c:629 at debug_print_object+0x1bc/0x450, CPU#9: ip/359

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72389

EUVD

EUVD-2026-59288

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's bridge networking subsystem. It occurs when the Spanning Tree Protocol (STP) topology change timer is armed while a network bridge is administratively down, leading to a crash when the bridge is later deleted. The issue stems from missing checks in the br_topology_change_detection() function.

Detection Guidance

This vulnerability is specific to the Linux kernel's bridge STP (Spanning Tree Protocol) implementation. Detection requires checking if the kernel version is vulnerable and inspecting bridge configurations for improper timer arming. Use 'uname -a' to check kernel version and 'ip link show' or 'brctl show' to inspect bridge interfaces.

Impact Analysis

If exploited, this vulnerability could cause a system crash (kernel panic) on affected Linux systems using network bridges with STP enabled. This would result in denial-of-service conditions, disrupting network services and potentially causing data loss or downtime.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a use-after-free issue in the Linux kernel's bridge STP timers, which could lead to system instability or crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Apply the latest kernel update from your distribution to patch the use-after-free flaw. If immediate patching is not possible, disable STP on affected bridges with 'brctl stp br0 off' or ensure bridges are not administratively down while timers are armed.

Hi! I’m here to help you understand CVE-2026-72389. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70