In the Linux kernel bridge module, a missing IFF_UP check in the topology‑change detection routine allows the STP topology‑change timer to be armed while the bridge interface is administratively down. If the bridge is then deleted, the timer callback can access already freed memory, producing a use‑after‑free kernel crash. This kernel memory‑corruption flaw could be exploited to cause a loss of system availability or, depending on circumstances, to gain higher privileges.

All kernels that include the legacy STP implementation in the bridge code, before the commit that adds the missing check and shuts down timers, are affected. The fix introduces the change in net/bridge/br_stp_timer.c and br_topology_change_detection(), making older kernel releases vulnerable.

The vulnerability requires the ability to delete a bridge interface that is administratively down; it is therefore likely limited to a local user with root privileges or a management service running as root. The CVSS score of 7.8 reflects high severity for kernel memory corruption, while the EPSS score of < 1 % indicates that exploitation is unlikely but not impossible. The issue is not included in the CISA KEV catalog. The inferred attack vector is local privileged, and the primary risk is a kernel panic or execution of arbitrary code.