The Linux kernel bridge CFM module contains a race condition that allows a peer MEP object to be freed while a delayed work task can still be scheduled against it. If a br_cfm_frame_rx() invocation schedules the work between the cancellation of delayed work and the actual free, the work function will later run against deallocated memory, creating a use‑after‑free flaw that can corrupt kernel state or crash the system. This flaw is identified as CWE‑825 and CWE‑362.

Linux kernel images that include the bridge driver with CFM support and contain the pre‑patch code path are affected. This includes kernels starting from 5.11 and all 7.x release candidate builds referenced in the CPE list, as long as they implement the CFM module. Operators should consider any kernel versions compiled before the commit that replaces cancel_delayed_work_sync() with disable_delayed_work_sync() as vulnerable.

The CVSS score of 7.8 signals high severity, and the EPSS score is below 1 % with the vulnerability not listed in CISA KEV, indicating a low overall likelihood of public exploitation. Based on the description, an attacker could send crafted CFM frames while a peer MEP deletion is in progress, a scenario that may be achievable by a network or local attacker with control over bridge traffic. The exploit would trigger the use‑after‑free, potentially causing kernel instability or a crash.