CVE-2024-40921

net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state

State: Published
Severity: Not scored
Published: Jul 12, 2024
Updated: May 23, 2026
Reserved: Jul 12, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state

Pass the already obtained vlan group pointer to br_mst_vlan_set_state() instead of dereferencing it again. Each caller has already correctly dereferenced it for their context. This change is required for the following suspicious RCU dereference fix. No functional changes intended.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8ca9a750fc711911ef616ceb627d07357b04545e to before 09f4337c27f5bdeb8646a6db91488cc2f7d537ffAffected 4488617e5e995a09abe4d81add5fb165674edb59 to before a6cc9e9a651b9861efa068c164ee62dfba68c6caAffected e43dd2b1ec746e105b7db5f9ad6ef14685a615a4 to before d2dc02775fc0c4eacaee833a0637e5958884a8e5Affected 3a7c1661ae1383364cd6092d851f5e5da64d476b to before 36c92936e868601fa1f43da6758cf55805043509Affected a2b01e65d9ba8af2bb086d3b7288ca53a07249acAffected 6.8.12 to before 6.9Affected
LinuxLinux	6.1.93 to before 6.1.95Affected 6.6.33 to before 6.6.35Affected 6.9.3 to before 6.9.6Affected

Product

Versions

LinuxLinux

8ca9a750fc711911ef616ceb627d07357b04545e to before 09f4337c27f5bdeb8646a6db91488cc2f7d537ffAffected
4488617e5e995a09abe4d81add5fb165674edb59 to before a6cc9e9a651b9861efa068c164ee62dfba68c6caAffected
e43dd2b1ec746e105b7db5f9ad6ef14685a615a4 to before d2dc02775fc0c4eacaee833a0637e5958884a8e5Affected
3a7c1661ae1383364cd6092d851f5e5da64d476b to before 36c92936e868601fa1f43da6758cf55805043509Affected
a2b01e65d9ba8af2bb086d3b7288ca53a07249acAffected
6.8.12 to before 6.9Affected

LinuxLinux

6.1.93 to before 6.1.95Affected
6.6.33 to before 6.6.35Affected
6.9.3 to before 6.9.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.