The Linux kernel bridge CFM module contains a race condition that allows a peer MEP object to be freed while a delayed work task can still be scheduled against it. If a br_cfm_frame_rx() invocation schedules the work between the cancellation of delayed work and the actual free, the work function will later run against deallocated memory, creating a use‑after‑free flaw that can corrupt kernel state or crash the system. This flaw is identified as CWE‑825.

Any Linux kernel image that includes the bridge driver with CFM support and contains the pre‑patch code path is affected. The advisory does not list a specific kernel release range, so systems running kernels built before the commit that replaces cancel_delayed_work_sync() with disable_delayed_work_sync() should be considered vulnerable.

The CVSS score of 7.8 signals high severity, though the EPSS score is below 1 % and the vulnerability is not currently in the CISA KEV catalog, implying low likelihood of public exploitation. An attacker would need to generate carefully crafted CFM traffic while a peer MEP deletion is in progress, suggesting a local or network attacker with the ability to influence the bridge device. Absent a public exploit, the risk remains significant for environments that require high integrity or uptime.