Use-After-Free Vulnerability in Linux Kernel Bridge Multicast Configuration
CVE-2025-38248
Key Information:
Badges
What is CVE-2025-38248?
A use-after-free vulnerability in the Linux kernel's bridge subsystem can be exploited during router port configuration when multicast snooping is enabled. The glitch arises when a multicast router port gets re-added to the global list, despite being removed from it. This leads to memory management issues, including stale entries in both global and per-VLAN router port lists. The flaw could allow attackers to manipulate network traffic or cause system instability when new ports are added, creating a security risk that necessitates prompt attention through updates.
Affected Version(s)
Linux 2796d846d74a18cc6563e96eff8bf28c5e06f912
Linux 2796d846d74a18cc6563e96eff8bf28c5e06f912 < 7544f3f5b0b58c396f374d060898b5939da31709
Linux 5.15
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved