CVE-2024-36979 (GCVE-0-2024-36979)

Vulnerability from cvelistv5 – Published: 2024-06-19 13:35 – Updated: 2026-08-05 11:32
VLAI
Title
net: bridge: mst: fix vlan use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: fix vlan use-after-free syzbot reported a suspicious rcu usage[1] in bridge's mst code. While fixing it I noticed that nothing prevents a vlan to be freed while walking the list from the same path (br forward delay timer). Fix the rcu usage and also make sure we are not accessing freed memory by making br_mst_vlan_set_state use rcu read lock. [1] WARNING: suspicious RCU usage 6.9.0-rc6-syzkaller #0 Not tainted ----------------------------- net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage! ... stack backtrace: CPU: 1 PID: 8017 Comm: syz-executor.1 Not tainted 6.9.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712 nbp_vlan_group net/bridge/br_private.h:1599 [inline] br_mst_set_state+0x1ea/0x650 net/bridge/br_mst.c:105 br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47 br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88 call_timer_fn+0x18e/0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1844 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2429 run_timer_base kernel/time/timer.c:2438 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448 __do_softirq+0x2c6/0x980 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5758 Code: 2b 00 74 08 4c 89 f7 e8 ba d1 84 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25 RSP: 0018:ffffc90013657100 EFLAGS: 00000206 RAX: 0000000000000001 RBX: 1ffff920026cae2c RCX: 0000000000000001 RDX: dffffc0000000000 RSI: ffffffff8bcaca00 RDI: ffffffff8c1eaa60 RBP: ffffc90013657260 R08: ffffffff92efe507 R09: 1ffffffff25dfca0 R10: dffffc0000000000 R11: fffffbfff25dfca1 R12: 1ffff920026cae28 R13: dffffc0000000000 R14: ffffc90013657160 R15: 0000000000000246
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-24 15:36 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: ec7328b59176227216c461601c6bd0e922232a9b , < 8ca9a750fc711911ef616ceb627d07357b04545e (git)
Affected: ec7328b59176227216c461601c6bd0e922232a9b , < 4488617e5e995a09abe4d81add5fb165674edb59 (git)
Affected: ec7328b59176227216c461601c6bd0e922232a9b , < a2b01e65d9ba8af2bb086d3b7288ca53a07249ac (git)
Affected: ec7328b59176227216c461601c6bd0e922232a9b , < e43dd2b1ec746e105b7db5f9ad6ef14685a615a4 (git)
Affected: ec7328b59176227216c461601c6bd0e922232a9b , < 3a7c1661ae1383364cd6092d851f5e5da64d476b (git)
Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.93 , ≤ 6.1.* (semver)
Unaffected: 6.6.33 , ≤ 6.6.* (semver)
Unaffected: 6.8.12 , ≤ 6.8.* (semver)
Unaffected: 6.9.3 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36979",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-24T15:36:13.939816Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-24T15:36:22.198Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.547Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8ca9a750fc711911ef616ceb627d07357b04545e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4488617e5e995a09abe4d81add5fb165674edb59"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a2b01e65d9ba8af2bb086d3b7288ca53a07249ac"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e43dd2b1ec746e105b7db5f9ad6ef14685a615a4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3a7c1661ae1383364cd6092d851f5e5da64d476b"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_mst.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8ca9a750fc711911ef616ceb627d07357b04545e",
              "status": "affected",
              "version": "ec7328b59176227216c461601c6bd0e922232a9b",
              "versionType": "git"
            },
            {
              "lessThan": "4488617e5e995a09abe4d81add5fb165674edb59",
              "status": "affected",
              "version": "ec7328b59176227216c461601c6bd0e922232a9b",
              "versionType": "git"
            },
            {
              "lessThan": "a2b01e65d9ba8af2bb086d3b7288ca53a07249ac",
              "status": "affected",
              "version": "ec7328b59176227216c461601c6bd0e922232a9b",
              "versionType": "git"
            },
            {
              "lessThan": "e43dd2b1ec746e105b7db5f9ad6ef14685a615a4",
              "status": "affected",
              "version": "ec7328b59176227216c461601c6bd0e922232a9b",
              "versionType": "git"
            },
            {
              "lessThan": "3a7c1661ae1383364cd6092d851f5e5da64d476b",
              "status": "affected",
              "version": "ec7328b59176227216c461601c6bd0e922232a9b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_mst.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mst: fix vlan use-after-free\n\nsyzbot reported a suspicious rcu usage[1] in bridge\u0027s mst code. While\nfixing it I noticed that nothing prevents a vlan to be freed while\nwalking the list from the same path (br forward delay timer). Fix the rcu\nusage and also make sure we are not accessing freed memory by making\nbr_mst_vlan_set_state use rcu read lock.\n\n[1]\n WARNING: suspicious RCU usage\n 6.9.0-rc6-syzkaller #0 Not tainted\n -----------------------------\n net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage!\n ...\n stack backtrace:\n CPU: 1 PID: 8017 Comm: syz-executor.1 Not tainted 6.9.0-rc6-syzkaller #0\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\n Call Trace:\n  \u003cIRQ\u003e\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n  lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712\n  nbp_vlan_group net/bridge/br_private.h:1599 [inline]\n  br_mst_set_state+0x1ea/0x650 net/bridge/br_mst.c:105\n  br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47\n  br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88\n  call_timer_fn+0x18e/0x650 kernel/time/timer.c:1793\n  expire_timers kernel/time/timer.c:1844 [inline]\n  __run_timers kernel/time/timer.c:2418 [inline]\n  __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2429\n  run_timer_base kernel/time/timer.c:2438 [inline]\n  run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448\n  __do_softirq+0x2c6/0x980 kernel/softirq.c:554\n  invoke_softirq kernel/softirq.c:428 [inline]\n  __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633\n  irq_exit_rcu+0x9/0x30 kernel/softirq.c:645\n  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]\n  sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043\n  \u003c/IRQ\u003e\n  \u003cTASK\u003e\n asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702\n RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5758\n Code: 2b 00 74 08 4c 89 f7 e8 ba d1 84 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 \u003c4b\u003e c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25\n RSP: 0018:ffffc90013657100 EFLAGS: 00000206\n RAX: 0000000000000001 RBX: 1ffff920026cae2c RCX: 0000000000000001\n RDX: dffffc0000000000 RSI: ffffffff8bcaca00 RDI: ffffffff8c1eaa60\n RBP: ffffc90013657260 R08: ffffffff92efe507 R09: 1ffffffff25dfca0\n R10: dffffc0000000000 R11: fffffbfff25dfca1 R12: 1ffff920026cae28\n R13: dffffc0000000000 R14: ffffc90013657160 R15: 0000000000000246"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Both sides of the race are driven locally \u2014 the VLAN free comes from rtnetlink RTM_DELLINK (`bridge vlan del`) and the bridge/MST/STP setup from RTM_NEWLINK/RTM_SETLINK. A remote or adjacent peer can only nudge the STP state machine via BPDUs; it cannot free the VLAN, so network reachability alone is insufficient.\nAC:L - The attacker creates and controls both racing sides: it drives `br_set_state()`\u2192`br_mst_set_state()` at will by injecting STP BPDUs on its own bridge port (or by configuring a short forward_delay) while concurrently hammering `nbp_vlan_delete()` from another thread. The race is freely repeatable with no attacker-uncontrollable precondition.\nPR:L - All required operations (bridge creation, port enslavement, `mst_enable`, `stp_state`, VLAN add/delete) need only CAP_NET_ADMIN in the owning network namespace, which any unprivileged user obtains with `unshare -Urn`. No real root in the init namespace is required.\nUI:N - The attacker performs every step itself \u2014 namespace setup, bridge/MST configuration, BPDU injection and VLAN deletion. No victim action is involved.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; there is no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The unprotected walk reads freed memory and dereferences `v-\u003ebrvlan-\u003emsti` \u2014 a pointer loaded out of the freed allocation \u2014 so reclaiming the slab with controlled data yields an arbitrary kernel read, and the corrupted list traversal further exposes kernel memory.\nI:H - `br_mst_vlan_set_state()` writes into the freed object via `WRITE_ONCE(v-\u003estate, state)` and runs `br_multicast_enable_port_ctx()` on freed lock/timer state; following `v-\u003evlist.next` from reclaimed memory turns this into a write of an attacker-chosen state byte at an attacker-chosen address, a classic path to control-flow hijack.\nA:H - Use-after-free on `struct net_bridge_vlan` and potentially the whole freed `net_bridge_vlan_group` in softirq context reliably produces oopses/panics, and the race can be retriggered continuously to keep crashing the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:28.586Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8ca9a750fc711911ef616ceb627d07357b04545e"
        },
        {
          "url": "https://git.kernel.org/stable/c/4488617e5e995a09abe4d81add5fb165674edb59"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2b01e65d9ba8af2bb086d3b7288ca53a07249ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/e43dd2b1ec746e105b7db5f9ad6ef14685a615a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a7c1661ae1383364cd6092d851f5e5da64d476b"
        }
      ],
      "title": "net: bridge: mst: fix vlan use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36979",
    "datePublished": "2024-06-19T13:35:12.708Z",
    "dateReserved": "2024-05-30T15:25:07.082Z",
    "dateUpdated": "2026-08-05T11:32:28.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36979",
      "date": "2026-08-16",
      "epss": "0.00257",
      "percentile": "0.17532"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.18\", \"versionEndExcluding\": \"6.1.93\", \"matchCriteriaId\": \"1F607CCF-2E38-46A2-8403-EE0DC522FA61\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.33\", \"matchCriteriaId\": \"FCE796DF-3B50-4DC6-BAE5-95271068FC9E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.8.12\", \"matchCriteriaId\": \"80550309-67AB-4FD1-AC07-3DED5C4F01B2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.9\", \"versionEndExcluding\": \"6.9.3\", \"matchCriteriaId\": \"E07124C1-19E8-4D21-828D-9932A01D3011\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: bridge: mst: fix vlan use-after-free\\n\\nsyzbot reported a suspicious rcu usage[1] in bridge\u0027s mst code. While\\nfixing it I noticed that nothing prevents a vlan to be freed while\\nwalking the list from the same path (br forward delay timer). Fix the rcu\\nusage and also make sure we are not accessing freed memory by making\\nbr_mst_vlan_set_state use rcu read lock.\\n\\n[1]\\n WARNING: suspicious RCU usage\\n 6.9.0-rc6-syzkaller #0 Not tainted\\n -----------------------------\\n net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage!\\n ...\\n stack backtrace:\\n CPU: 1 PID: 8017 Comm: syz-executor.1 Not tainted 6.9.0-rc6-syzkaller #0\\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\\n Call Trace:\\n  \u003cIRQ\u003e\\n  __dump_stack lib/dump_stack.c:88 [inline]\\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\\n  lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712\\n  nbp_vlan_group net/bridge/br_private.h:1599 [inline]\\n  br_mst_set_state+0x1ea/0x650 net/bridge/br_mst.c:105\\n  br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47\\n  br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88\\n  call_timer_fn+0x18e/0x650 kernel/time/timer.c:1793\\n  expire_timers kernel/time/timer.c:1844 [inline]\\n  __run_timers kernel/time/timer.c:2418 [inline]\\n  __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2429\\n  run_timer_base kernel/time/timer.c:2438 [inline]\\n  run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448\\n  __do_softirq+0x2c6/0x980 kernel/softirq.c:554\\n  invoke_softirq kernel/softirq.c:428 [inline]\\n  __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633\\n  irq_exit_rcu+0x9/0x30 kernel/softirq.c:645\\n  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]\\n  sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043\\n  \u003c/IRQ\u003e\\n  \u003cTASK\u003e\\n asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702\\n RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5758\\n Code: 2b 00 74 08 4c 89 f7 e8 ba d1 84 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 \u003c4b\u003e c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25\\n RSP: 0018:ffffc90013657100 EFLAGS: 00000206\\n RAX: 0000000000000001 RBX: 1ffff920026cae2c RCX: 0000000000000001\\n RDX: dffffc0000000000 RSI: ffffffff8bcaca00 RDI: ffffffff8c1eaa60\\n RBP: ffffc90013657260 R08: ffffffff92efe507 R09: 1ffffffff25dfca0\\n R10: dffffc0000000000 R11: fffffbfff25dfca1 R12: 1ffff920026cae28\\n R13: dffffc0000000000 R14: ffffc90013657160 R15: 0000000000000246\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: net: bridge: mst: fix vlan use-after-free syzbot inform\\u00f3 un uso sospechoso de rcu[1] en el c\\u00f3digo mst del puente. Mientras lo solucionaba, not\\u00e9 que nada impide que se libere una VLAN mientras se recorre la lista desde el mismo camino (br temporizador de retardo de avance). Corrija el uso de rcu y tambi\\u00e9n aseg\\u00farese de que no accedamos a la memoria liberada haciendo que br_mst_vlan_set_state use el bloqueo de lectura de rcu. [1] ADVERTENCIA: uso sospechoso de RCU 6.9.0-rc6-syzkaller #0 No contaminado ----------------------- net/ bridge/br_private.h:1599 \\u00a1uso sospechoso de rcu_dereference_protected()! ... seguimiento de pila: CPU: 1 PID: 8017 Comm: syz-executor.1 No contaminado 6.9.0-rc6-syzkaller #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 27/03/2024 Llamada Seguimiento:  __dump_stack lib/dump_stack.c:88 [en l\\u00ednea] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712 nbp_vlan_group net/bridge/br_private.h :1599 [en l\\u00ednea] br_mst_set_state+0x1ea/0x650 net/bridge/br_mst.c:105 br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47 br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88 n+0x18e /0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1844 [en l\\u00ednea] __run_timers kernel/time/timer.c:2418 [en l\\u00ednea] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c: 2429 run_timer_base kernel/time/timer.c:2438 [en l\\u00ednea] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448 __do_softirq+0x2c6/0x980 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [en l\\u00ednea ] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [en l\\u00ednea] 0xc0 arco/x86 /kernel/apic/apic.c:1043   asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep. c:5758 C\\u00f3digo: 2b 00 74 08 4c 89 f7 e8 ba d1 84 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 \u0026lt;4b\u0026gt; c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25 RSP: 0018:ffffc90013657100 EFLAGS: 00000206 RAX: 0000000000000001 RBX: ffff920026cae2c RCX: 0000000000000001 RDX: dffffc0000000000 RSI: ffffffff8bcaca00 RDI: ffffffff8c1eaa60 RBP: ffffc90013657260 R08: ffffffff92efe507 R09: 1ffffffff25dfca0 R10: dffffc0000000000 R11: ffffbfff25dfca1 R12: 1ffff920026cae28 R13: dffffc0000000000 R14: ffffc90013657160 5: 0000000000000246\"}]",
      "id": "CVE-2024-36979",
      "lastModified": "2024-11-21T09:22:57.820",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-06-19T14:15:13.620",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/3a7c1661ae1383364cd6092d851f5e5da64d476b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4488617e5e995a09abe4d81add5fb165674edb59\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8ca9a750fc711911ef616ceb627d07357b04545e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a2b01e65d9ba8af2bb086d3b7288ca53a07249ac\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e43dd2b1ec746e105b7db5f9ad6ef14685a615a4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3a7c1661ae1383364cd6092d851f5e5da64d476b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4488617e5e995a09abe4d81add5fb165674edb59\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8ca9a750fc711911ef616ceb627d07357b04545e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a2b01e65d9ba8af2bb086d3b7288ca53a07249ac\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e43dd2b1ec746e105b7db5f9ad6ef14685a615a4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36979\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-19T14:15:13.620\",\"lastModified\":\"2026-08-04T11:18:38.480\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: bridge: mst: fix vlan use-after-free\\n\\nsyzbot reported a suspicious rcu usage[1] in bridge\u0027s mst code. While\\nfixing it I noticed that nothing prevents a vlan to be freed while\\nwalking the list from the same path (br forward delay timer). Fix the rcu\\nusage and also make sure we are not accessing freed memory by making\\nbr_mst_vlan_set_state use rcu read lock.\\n\\n[1]\\n WARNING: suspicious RCU usage\\n 6.9.0-rc6-syzkaller #0 Not tainted\\n -----------------------------\\n net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage!\\n ...\\n stack backtrace:\\n CPU: 1 PID: 8017 Comm: syz-executor.1 Not tainted 6.9.0-rc6-syzkaller #0\\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\\n Call Trace:\\n  \u003cIRQ\u003e\\n  __dump_stack lib/dump_stack.c:88 [inline]\\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\\n  lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712\\n  nbp_vlan_group net/bridge/br_private.h:1599 [inline]\\n  br_mst_set_state+0x1ea/0x650 net/bridge/br_mst.c:105\\n  br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47\\n  br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88\\n  call_timer_fn+0x18e/0x650 kernel/time/timer.c:1793\\n  expire_timers kernel/time/timer.c:1844 [inline]\\n  __run_timers kernel/time/timer.c:2418 [inline]\\n  __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2429\\n  run_timer_base kernel/time/timer.c:2438 [inline]\\n  run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448\\n  __do_softirq+0x2c6/0x980 kernel/softirq.c:554\\n  invoke_softirq kernel/softirq.c:428 [inline]\\n  __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633\\n  irq_exit_rcu+0x9/0x30 kernel/softirq.c:645\\n  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]\\n  sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043\\n  \u003c/IRQ\u003e\\n  \u003cTASK\u003e\\n asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702\\n RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5758\\n Code: 2b 00 74 08 4c 89 f7 e8 ba d1 84 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 \u003c4b\u003e c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25\\n RSP: 0018:ffffc90013657100 EFLAGS: 00000206\\n RAX: 0000000000000001 RBX: 1ffff920026cae2c RCX: 0000000000000001\\n RDX: dffffc0000000000 RSI: ffffffff8bcaca00 RDI: ffffffff8c1eaa60\\n RBP: ffffc90013657260 R08: ffffffff92efe507 R09: 1ffffffff25dfca0\\n R10: dffffc0000000000 R11: fffffbfff25dfca1 R12: 1ffff920026cae28\\n R13: dffffc0000000000 R14: ffffc90013657160 R15: 0000000000000246\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: net: bridge: mst: fix vlan use-after-free syzbot inform\u00f3 un uso sospechoso de rcu[1] en el c\u00f3digo mst del puente. Mientras lo solucionaba, not\u00e9 que nada impide que se libere una VLAN mientras se recorre la lista desde el mismo camino (br temporizador de retardo de avance). Corrija el uso de rcu y tambi\u00e9n aseg\u00farese de que no accedamos a la memoria liberada haciendo que br_mst_vlan_set_state use el bloqueo de lectura de rcu. [1] ADVERTENCIA: uso sospechoso de RCU 6.9.0-rc6-syzkaller #0 No contaminado ----------------------- net/ bridge/br_private.h:1599 \u00a1uso sospechoso de rcu_dereference_protected()! ... seguimiento de pila: CPU: 1 PID: 8017 Comm: syz-executor.1 No contaminado 6.9.0-rc6-syzkaller #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 27/03/2024 Llamada Seguimiento:  __dump_stack lib/dump_stack.c:88 [en l\u00ednea] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712 nbp_vlan_group net/bridge/br_private.h :1599 [en l\u00ednea] br_mst_set_state+0x1ea/0x650 net/bridge/br_mst.c:105 br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47 br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88 n+0x18e /0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1844 [en l\u00ednea] __run_timers kernel/time/timer.c:2418 [en l\u00ednea] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c: 2429 run_timer_base kernel/time/timer.c:2438 [en l\u00ednea] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448 __do_softirq+0x2c6/0x980 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [en l\u00ednea ] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [en l\u00ednea] 0xc0 arco/x86 /kernel/apic/apic.c:1043   asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep. c:5758 C\u00f3digo: 2b 00 74 08 4c 89 f7 e8 ba d1 84 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 \u0026lt;4b\u0026gt; c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25 RSP: 0018:ffffc90013657100 EFLAGS: 00000206 RAX: 0000000000000001 RBX: ffff920026cae2c RCX: 0000000000000001 RDX: dffffc0000000000 RSI: ffffffff8bcaca00 RDI: ffffffff8c1eaa60 RBP: ffffc90013657260 R08: ffffffff92efe507 R09: 1ffffffff25dfca0 R10: dffffc0000000000 R11: ffffbfff25dfca1 R12: 1ffff920026cae28 R13: dffffc0000000000 R14: ffffc90013657160 5: 0000000000000246\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bridge/br_mst.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ec7328b59176227216c461601c6bd0e922232a9b\",\"lessThan\":\"8ca9a750fc711911ef616ceb627d07357b04545e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec7328b59176227216c461601c6bd0e922232a9b\",\"lessThan\":\"4488617e5e995a09abe4d81add5fb165674edb59\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec7328b59176227216c461601c6bd0e922232a9b\",\"lessThan\":\"a2b01e65d9ba8af2bb086d3b7288ca53a07249ac\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec7328b59176227216c461601c6bd0e922232a9b\",\"lessThan\":\"e43dd2b1ec746e105b7db5f9ad6ef14685a615a4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec7328b59176227216c461601c6bd0e922232a9b\",\"lessThan\":\"3a7c1661ae1383364cd6092d851f5e5da64d476b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bridge/br_mst.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.93\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.33\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.12\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.3\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-24T15:36:13.939816Z\",\"id\":\"CVE-2024-36979\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"6.1.93\",\"matchCriteriaId\":\"1F607CCF-2E38-46A2-8403-EE0DC522FA61\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.33\",\"matchCriteriaId\":\"FCE796DF-3B50-4DC6-BAE5-95271068FC9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.12\",\"matchCriteriaId\":\"80550309-67AB-4FD1-AC07-3DED5C4F01B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.9.3\",\"matchCriteriaId\":\"E07124C1-19E8-4D21-828D-9932A01D3011\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3a7c1661ae1383364cd6092d851f5e5da64d476b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4488617e5e995a09abe4d81add5fb165674edb59\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ca9a750fc711911ef616ceb627d07357b04545e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a2b01e65d9ba8af2bb086d3b7288ca53a07249ac\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e43dd2b1ec746e105b7db5f9ad6ef14685a615a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3a7c1661ae1383364cd6092d851f5e5da64d476b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4488617e5e995a09abe4d81add5fb165674edb59\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ca9a750fc711911ef616ceb627d07357b04545e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a2b01e65d9ba8af2bb086d3b7288ca53a07249ac\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e43dd2b1ec746e105b7db5f9ad6ef14685a615a4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:56:57+00:00",
      "cve": "CVE-2024-36979",
      "id": "CVE-2024-36979",
      "initial_release_date": "2024-06-19T00:00:00+00:00",
      "product_status:fixed": "783",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: bridge: mst: fix vlan use-after-free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36979.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-23T02:05:02Z",
      "cve": "CVE-2024-36979",
      "id": "CVE-2024-36979",
      "initial_release_date": "2024-06-21T03:06:51Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "299",
      "product_status:recommended": "419",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-36979",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-36979.json",
      "version": "94"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8ca9a750fc711911ef616ceb627d07357b04545e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4488617e5e995a09abe4d81add5fb165674edb59\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a2b01e65d9ba8af2bb086d3b7288ca53a07249ac\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e43dd2b1ec746e105b7db5f9ad6ef14685a615a4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3a7c1661ae1383364cd6092d851f5e5da64d476b\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:43:50.547Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36979\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-24T15:36:13.939816Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-24T15:36:19.145Z\"}}], \"cna\": {\"title\": \"net: bridge: mst: fix vlan use-after-free\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ec7328b59176227216c461601c6bd0e922232a9b\", \"lessThan\": \"8ca9a750fc711911ef616ceb627d07357b04545e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ec7328b59176227216c461601c6bd0e922232a9b\", \"lessThan\": \"4488617e5e995a09abe4d81add5fb165674edb59\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ec7328b59176227216c461601c6bd0e922232a9b\", \"lessThan\": \"a2b01e65d9ba8af2bb086d3b7288ca53a07249ac\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ec7328b59176227216c461601c6bd0e922232a9b\", \"lessThan\": \"e43dd2b1ec746e105b7db5f9ad6ef14685a615a4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ec7328b59176227216c461601c6bd0e922232a9b\", \"lessThan\": \"3a7c1661ae1383364cd6092d851f5e5da64d476b\", \"versionType\": \"git\"}], \"programFiles\": [\"net/bridge/br_mst.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/bridge/br_mst.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8ca9a750fc711911ef616ceb627d07357b04545e\"}, {\"url\": \"https://git.kernel.org/stable/c/4488617e5e995a09abe4d81add5fb165674edb59\"}, {\"url\": \"https://git.kernel.org/stable/c/a2b01e65d9ba8af2bb086d3b7288ca53a07249ac\"}, {\"url\": \"https://git.kernel.org/stable/c/e43dd2b1ec746e105b7db5f9ad6ef14685a615a4\"}, {\"url\": \"https://git.kernel.org/stable/c/3a7c1661ae1383364cd6092d851f5e5da64d476b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: bridge: mst: fix vlan use-after-free\\n\\nsyzbot reported a suspicious rcu usage[1] in bridge\u0027s mst code. While\\nfixing it I noticed that nothing prevents a vlan to be freed while\\nwalking the list from the same path (br forward delay timer). Fix the rcu\\nusage and also make sure we are not accessing freed memory by making\\nbr_mst_vlan_set_state use rcu read lock.\\n\\n[1]\\n WARNING: suspicious RCU usage\\n 6.9.0-rc6-syzkaller #0 Not tainted\\n -----------------------------\\n net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage!\\n ...\\n stack backtrace:\\n CPU: 1 PID: 8017 Comm: syz-executor.1 Not tainted 6.9.0-rc6-syzkaller #0\\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\\n Call Trace:\\n  \u003cIRQ\u003e\\n  __dump_stack lib/dump_stack.c:88 [inline]\\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\\n  lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712\\n  nbp_vlan_group net/bridge/br_private.h:1599 [inline]\\n  br_mst_set_state+0x1ea/0x650 net/bridge/br_mst.c:105\\n  br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47\\n  br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88\\n  call_timer_fn+0x18e/0x650 kernel/time/timer.c:1793\\n  expire_timers kernel/time/timer.c:1844 [inline]\\n  __run_timers kernel/time/timer.c:2418 [inline]\\n  __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2429\\n  run_timer_base kernel/time/timer.c:2438 [inline]\\n  run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448\\n  __do_softirq+0x2c6/0x980 kernel/softirq.c:554\\n  invoke_softirq kernel/softirq.c:428 [inline]\\n  __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633\\n  irq_exit_rcu+0x9/0x30 kernel/softirq.c:645\\n  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]\\n  sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043\\n  \u003c/IRQ\u003e\\n  \u003cTASK\u003e\\n asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702\\n RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5758\\n Code: 2b 00 74 08 4c 89 f7 e8 ba d1 84 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 \u003c4b\u003e c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25\\n RSP: 0018:ffffc90013657100 EFLAGS: 00000206\\n RAX: 0000000000000001 RBX: 1ffff920026cae2c RCX: 0000000000000001\\n RDX: dffffc0000000000 RSI: ffffffff8bcaca00 RDI: ffffffff8c1eaa60\\n RBP: ffffc90013657260 R08: ffffffff92efe507 R09: 1ffffffff25dfca0\\n R10: dffffc0000000000 R11: fffffbfff25dfca1 R12: 1ffff920026cae28\\n R13: dffffc0000000000 R14: ffffc90013657160 R15: 0000000000000246\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.93\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.33\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.12\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.3\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"5.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:18:22.377Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36979\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:18:22.377Z\", \"dateReserved\": \"2024-05-30T15:25:07.082Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-19T13:35:12.708Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.