CVE-2024-40920 (GCVE-0-2024-40920)
Vulnerability from cvelistv5
Published
2024-07-12 12:25
Modified
2026-08-05 11:34
Severity ?
7.1 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state I converted br_mst_set_state to RCU to avoid a vlan use-after-free but forgot to change the vlan group dereference helper. Switch to vlan group RCU deref helper to fix the suspicious rcu usage warning.
References
Impacted products
Vendor Product Version
Linux Linux Version: 8ca9a750fc711911ef616ceb627d07357b04545e
Version: 4488617e5e995a09abe4d81add5fb165674edb59
Version: e43dd2b1ec746e105b7db5f9ad6ef14685a615a4
Version: 3a7c1661ae1383364cd6092d851f5e5da64d476b
Version: a2b01e65d9ba8af2bb086d3b7288ca53a07249ac
Version: 6.8.12   ≤
Create a notification for this product.
   Linux Linux Version: 6.1.93   ≤
Version: 6.6.33   ≤
Version: 6.9.3   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:57:50.802Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40920",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:05:33.673278Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:03.619Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_mst.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "caaa2129784a04dcade0ea92c12e6ff90bbd23d8",
              "status": "affected",
              "version": "8ca9a750fc711911ef616ceb627d07357b04545e",
              "versionType": "git"
            },
            {
              "lessThan": "7caefa2771722e65496d85b62e1dc4442b7d1345",
              "status": "affected",
              "version": "4488617e5e995a09abe4d81add5fb165674edb59",
              "versionType": "git"
            },
            {
              "lessThan": "406bfc04b01ee47e4c626f77ecc7d9f85135b166",
              "status": "affected",
              "version": "e43dd2b1ec746e105b7db5f9ad6ef14685a615a4",
              "versionType": "git"
            },
            {
              "lessThan": "546ceb1dfdac866648ec959cbc71d9525bd73462",
              "status": "affected",
              "version": "3a7c1661ae1383364cd6092d851f5e5da64d476b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a2b01e65d9ba8af2bb086d3b7288ca53a07249ac",
              "versionType": "git"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.12",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_mst.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.1.95",
              "status": "affected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.35",
              "status": "affected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9.6",
              "status": "affected",
              "version": "6.9.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.95",
                  "versionStartIncluding": "6.1.93",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.35",
                  "versionStartIncluding": "6.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.6",
                  "versionStartIncluding": "6.9.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mst: fix suspicious rcu usage in br_mst_set_state\n\nI converted br_mst_set_state to RCU to avoid a vlan use-after-free\nbut forgot to change the vlan group dereference helper. Switch to vlan\ngroup RCU deref helper to fix the suspicious rcu usage warning."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The buggy dereference is reached from the STP BPDU receive path (`br_stp_rcv` \u2192 `br_port_state_selection` \u2192 `br_set_state` \u2192 `br_mst_set_state`), so an attacker on the same L2 segment can drive port state transitions into it; STP BPDUs use the link-local `01:80:C2:00:00:00` LLC group address and are not routable, so this is adjacent rather than network.\nAC:L - On an MST-enabled bridge running kernel STP the unannotated dereference is hit deterministically on every port state transition, and the attacker drives both sides \u2014 flapping BPDUs force repeated transitions while port add/remove concurrently republishes `p-\u003evlgrp` \u2014 with no timing window or memory layout that must be won.\nPR:N - STP BPDU processing in `br_stp_rcv()` has no authentication whatsoever \u2014 a frame from the segment is accepted on any non-disabled, non-BPDU-guarded port \u2014 so the adjacent attacker needs no credentials on the target host.\nUI:N - Port state transitions occur automatically from received BPDUs and from the forward-delay timer; no administrator or user action is needed once the bridge is in MST mode.\nS:U - The faulty dereference, the resulting fault, and the log disclosure are all confined to the kernel that owns the bridge; no VM, IOMMU, or sandbox boundary is crossed.\nC:L - The `lockdep_rcu_suspicious()` report dumps a full kernel backtrace with raw stack and register addresses (as seen in the syzbot trace) into the kernel log, disclosing text and stack layout useful for defeating KASLR; there is no bulk or arbitrary memory read.\nI:N - The defect is a read-side annotation mismatch \u2014 no attacker-controlled data is written and no out-of-bounds or freed memory is modified, so no write or control-flow-hijack primitive results.\nA:H - Without the RCU dereference the load of `p-\u003evlgrp` carries no `READ_ONCE()` or dependency ordering, so a softirq reader racing a concurrent `nbp_vlan_flush()`/`nbp_vlan_init()` can traverse `vg-\u003evlan_list` and write `vg-\u003epvid_state` on a NULL or not-yet-published group, oopsing the kernel and taking down the bridging host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:00.976Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345"
        },
        {
          "url": "https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166"
        },
        {
          "url": "https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462"
        }
      ],
      "title": "net: bridge: mst: fix suspicious rcu usage in br_mst_set_state",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40920",
    "datePublished": "2024-07-12T12:25:02.222Z",
    "dateReserved": "2024-07-12T12:17:45.582Z",
    "dateUpdated": "2026-08-05T11:34:00.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T21:57:50.802Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40920\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:05:33.673278Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:14.304Z\"}}], \"cna\": {\"title\": \"net: bridge: mst: fix suspicious rcu usage in br_mst_set_state\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8ca9a750fc711911ef616ceb627d07357b04545e\", \"lessThan\": \"caaa2129784a04dcade0ea92c12e6ff90bbd23d8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4488617e5e995a09abe4d81add5fb165674edb59\", \"lessThan\": \"7caefa2771722e65496d85b62e1dc4442b7d1345\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e43dd2b1ec746e105b7db5f9ad6ef14685a615a4\", \"lessThan\": \"406bfc04b01ee47e4c626f77ecc7d9f85135b166\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3a7c1661ae1383364cd6092d851f5e5da64d476b\", \"lessThan\": \"546ceb1dfdac866648ec959cbc71d9525bd73462\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a2b01e65d9ba8af2bb086d3b7288ca53a07249ac\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6.8.12\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/bridge/br_mst.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.1.93\", \"lessThan\": \"6.1.95\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.6.33\", \"lessThan\": \"6.6.35\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.9.3\", \"lessThan\": \"6.9.6\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/bridge/br_mst.c\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8\"}, {\"url\": \"https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345\"}, {\"url\": \"https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166\"}, {\"url\": \"https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: bridge: mst: fix suspicious rcu usage in br_mst_set_state\\n\\nI converted br_mst_set_state to RCU to avoid a vlan use-after-free\\nbut forgot to change the vlan group dereference helper. Switch to vlan\\ngroup RCU deref helper to fix the suspicious rcu usage warning.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.95\", \"versionStartIncluding\": \"6.1.93\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.35\", \"versionStartIncluding\": \"6.6.33\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.6\", \"versionStartIncluding\": \"6.9.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.8.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:51:02.195Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40920\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:51:02.195Z\", \"dateReserved\": \"2024-07-12T12:17:45.582Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:25:02.222Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.