Riskcovery

CVE-2024-40920

net: bridge: mst: fix suspicious rcu usage in br_mst_set_state

State
Published
Severity
7.1 High
Published
Jul 12, 2024
Updated
Aug 5, 2026
Reserved
Jul 12, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mst: fix suspicious rcu usage in br_mst_set_state

I converted br_mst_set_state to RCU to avoid a vlan use-after-free but forgot to change the vlan group dereference helper. Switch to vlan group RCU deref helper to fix the suspicious rcu usage warning.

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 8ca9a750fc711911ef616ceb627d07357b04545e to before caaa2129784a04dcade0ea92c12e6ff90bbd23d8Affected
  • 4488617e5e995a09abe4d81add5fb165674edb59 to before 7caefa2771722e65496d85b62e1dc4442b7d1345Affected
  • e43dd2b1ec746e105b7db5f9ad6ef14685a615a4 to before 406bfc04b01ee47e4c626f77ecc7d9f85135b166Affected
  • 3a7c1661ae1383364cd6092d851f5e5da64d476b to before 546ceb1dfdac866648ec959cbc71d9525bd73462Affected
  • a2b01e65d9ba8af2bb086d3b7288ca53a07249acAffected
  • 6.8.12 to before 6.9Affected
LinuxLinux
  • 6.1.93 to before 6.1.95Affected
  • 6.6.33 to before 6.6.35Affected
  • 6.9.3 to before 6.9.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.