The Linux kernel bridge MST module contains a flaw where the function that changes MST state calls a switchdev attribute function while an RCU read lock is held. The switchdev notifier chain can block and sleep, which is forbidden inside an RCU read‑side critical section, creating the possibility of a kernel crash or system instability. This vulnerability does not provide remote code execution but can destabilize the system if triggered.

All Linux kernel builds that include the bridge MST feature and have not applied the upstream commit that moves the switchdev call outside the RCU section are vulnerable. The issue applies to all mainstream kernel releases that expose this feature, regardless of specific minor version.

The CVSS score of 7.0 indicates a high severity potential for serious disruption. The EPSS score of less than 1% indicates a very low estimated exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require local or privileged access to send netlink commands while holding the rtnl lock, and no publicly documented remote attack vector is known.