The Linux kernel’s bridge subsystem registers a single, global frame handler for CFM and MRP protocols. When these protocols are enabled on multiple network bridges, the same handler node is inadvertently inserted into each bridge’s frame list. Removing the handler from one bridge corrupts the list of the remaining bridges, leading to pointer corruption and potentially crashing the kernel. This flaw is an instance of CWE-1108, which involves improper handling of data structures and recursive list manipulation.

All Linux kernel releases that compile the bridge CFM or MRP features (CONFIG_BRIDGE_CFM and CONFIG_BRIDGE_MRP) are susceptible, regardless of the specific kernel version. The risk manifests only when more than one bridge is created with these protocols enabled and the protocols are subsequently disabled on any bridge. Systems with a single bridge or with the protocols disabled are unaffected.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% shows a low probability of exploitation. The flaw is not cataloged in CISA's KEV list. Exploitation would require local privilege to modify bridge configuration or send crafted bridge frames to a victim machine; remote exploitation appears infeasible. An attacker who can control bridge settings could force an untrusted bridge to unregister the shared handler, precipitating a kernel crash or denial of service on the local host.