CVE-2026-72389

A flaw was found in the Linux kernel's bridge Spanning Tree Protocol STP module. A missing check in the brtopologychangedetection function allows a topology change timer to be armed while a bridge is administratively down. This can be exploited by an attacker to trigger a use-after-free...

SUSE CVE-2026-72389

In the Linux kernel, the following vulnerability has been resolved: bridge: stp: Fix a potential use-after-free when deleting a bridge The three STP timers are not supposed to be armed while the bridge is administratively down. They are synchronously deactivated when the bridge is put...