Linux Kernel Bridge STP Use-After-Free Vulnerability Discovered

A use-after-free vulnerability exists in the Linux kernel’s bridge (net/bridge) Spanning Tree Protocol (STP) implementation. The issue occurs when a bridge is administratively down while STP is enabled, and a port enters the LEARNING state, causing periodic STP timers to activate without an IFF_UP guard. During teardown via dellink, these timers are not synchronously deleted, leading to the freeing of the net_device structure while timers remain queued. This results in a slab use-after-free in the kmalloc-cg-8k cache.