Use-After-Free Vulnerability in Linux Kernel Bridge Multicast Configuration
CVE-2025-38248
Currently unrated
What is CVE-2025-38248?
A use-after-free vulnerability in the Linux kernel's bridge subsystem can be exploited during router port configuration when multicast snooping is enabled. The glitch arises when a multicast router port gets re-added to the global list, despite being removed from it. This leads to memory management issues, including stale entries in both global and per-VLAN router port lists. The flaw could allow attackers to manipulate network traffic or cause system instability when new ports are added, creating a security risk that necessitates prompt attention through updates.
Affected Version(s)
Linux 2796d846d74a18cc6563e96eff8bf28c5e06f912
Linux 2796d846d74a18cc6563e96eff8bf28c5e06f912 < 7544f3f5b0b58c396f374d060898b5939da31709
Linux 5.15