Threats tagged 'ghsa-9jpf-8hq9-w5f5'

A use-after-free vulnerability in the Linux kernel's network bridge code was resolved. The issue arises from a race condition during deletion of an expired forwarding database (fdb) entry when MST (Multiple Spanning Tree) is enabled and VLAN filtering is disabled. This condition allows bypassing the port's disabled state, causing fdb learning to occur improperly while the port is being deleted. The fix involves adding a check on the port's VLAN group pointer to prevent this bypass. The vulnerability has a high severity rating based on CVSS 3.1 metrics.