A flaw in the Linux bridge subsystem triggers a use‑after‑free of a master VLAN’s multicast context when the VLAN is removed and the bridge’s multicast receive path simultaneously accesses the freed context. The kernel’s RCU mechanism allows the context to be freed while still referenced, which can lead to memory corruption and potentially arbitrary code execution if an attacker can influence the timing of multicast or VLAN teardown actions.

All Linux kernel implementations that include the network bridge driver and support VLANs can be affected; the issue is present in any kernel version until the security patch is applied. No specific release numbers are given, so any system with an unpatched kernel should verify that the latest kernel release contains the fix.

No CVSS or EPSS score is provided and the vulnerability is not listed in the CISA KEV catalog. The flaw involves kernel memory manipulation, so its potential impact is high, but the attack vector requires an attacker to send crafted multicast or VLAN traffic to a bridge device, which can be achieved from hosts local to or remote from the network. No public exploit has been disclosed, but the absence of a mitigation strongly recommends patching.