CVE-2025-38248: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38248 Overview

CVE-2025-38248 is a use-after-free vulnerability [CWE-416] in the Linux kernel's bridge multicast (br_multicast) subsystem. The flaw affects router port configuration when per-VLAN multicast snooping is toggled. A local user with CAP_NET_ADMIN can trigger stale entries in the global or per-VLAN router port list by re-adding a port after multicast snooping state changes. Traversing these stale lists results in memory corruption inside br_multicast_add_router. The vulnerability affects Linux kernel versions including 6.16-rc1, 6.16-rc2, and 6.16-rc3.

Critical Impact
Local attackers with network administration privileges can trigger a kernel use-after-free, enabling privilege escalation or denial of service through corrupted bridge multicast router port lists.

Affected Products

Linux Kernel (mainline, prior to fix commits)
Linux Kernel 6.16-rc1, 6.16-rc2, 6.16-rc3
Distributions shipping affected kernel versions with bridge multicast snooping enabled

Discovery Timeline

2025-07-09 - CVE-2025-38248 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38248

Vulnerability Analysis

The Linux bridge driver maintains two router port lists: a global list consulted during multicast forwarding, and per-VLAN router port lists used when per-VLAN multicast snooping is enabled. The bridge forwards multicast packets to router ports regardless of MDB entry membership. This routing behavior depends on the integrity of these lists during port and VLAN lifecycle transitions.

When per-VLAN multicast snooping is enabled, the per-port multicast context is disabled and the port is removed from the global router port list. However, subsequent calls that reset mcast_router state can re-add the port to the global list even after per-VLAN snooping is active. A parallel bug exists in the per-VLAN router port list when per-VLAN snooping is disabled.

Root Cause

The regression originates in commit 4b30ae9adb04 ("net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions"). After that change, disabling multicast on a port toggles the per-{port, VLAN} contexts rather than the per-port context when per-VLAN snooping is active. As a result, br_multicast_port_ctx_deinit() never removes the port from the router port list during port or VLAN deletion. Deleting the multicast router timer only handles temporary router states (1 or 3), not the permanent state (2), leaving dangling hlist entries pointing to freed memory.

Attack Vector

Exploitation requires local access with CAP_NET_ADMIN to manipulate bridge configuration through iproute2 or netlink. An attacker creates a bridge with vlan_filtering and mcast_snooping enabled, configures a slave port with mcast_router 2 (permanent router state), toggles per-VLAN snooping, deletes the port or VLAN, and then adds a new port. The list traversal in br_multicast_add_router.part.0 then performs a write to freed slab memory, detected by KASAN as slab-out-of-bounds. Successful exploitation can lead to kernel memory corruption and privilege escalation.

No public proof-of-concept exploit is currently listed, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-38248

Indicators of Compromise

Kernel KASAN reports referencing br_multicast_add_router with slab-out-of-bounds write access
Unexpected kernel panics or general protection fault messages originating from net/bridge/br_multicast.c
Bridge configurations where router ports appear in bridge -d mdb show after per-VLAN snooping state transitions

Detection Strategies

Audit kernel versions across Linux fleet against the fixed commits (4d3c2a1d4c7c, 7544f3f5b0b5, bdced577da71, f05a4f9e959e) referenced in the kernel.org stable tree.
Monitor dmesg and journalctl -k for KASAN or oops messages tied to the bridge multicast subsystem.
Track invocations of ip link set ... type bridge_slave mcast_router and bridge vlan set ... mcast_router from unprivileged administrative contexts.

Monitoring Recommendations

Enable auditd rules on netlink socket usage (AF_NETLINK) tied to bridge and VLAN configuration changes.
Forward kernel logs to a centralized logging platform and alert on stack traces containing br_multicast_port_ctx_deinit or br_multicast_add_router.
Review host inventory for systems using bridge devices with mcast_vlan_snooping enabled and flag those pending patch.

How to Mitigate CVE-2025-38248

Immediate Actions Required

Update to a Linux kernel version that includes the upstream fix removing the port from the router port list inside br_multicast_port_ctx_deinit().
Restrict CAP_NET_ADMIN to trusted administrators and remove it from container workloads that do not require bridge manipulation.
Inventory hosts using mcast_vlan_snooping and prioritize them for patching.

Patch Information

The issue is resolved in the upstream Linux kernel through the following stable commits: 4d3c2a1d4c7c, 7544f3f5b0b5, bdced577da71, and f05a4f9e959e. The fix moves the router port list removal into br_multicast_port_ctx_deinit(), ensuring cleanup during both port deletion and VLAN deletion. Apply distribution-provided kernel updates that backport these commits.

Workarounds

Disable per-VLAN multicast snooping (mcast_vlan_snooping 0) on bridges where it is not required until the kernel is patched.
Avoid toggling mcast_router between values 0 and 2 on bridge slave ports after enabling per-VLAN snooping.
Remove unprivileged user access to bridge configuration commands and namespaces that grant CAP_NET_ADMIN.

bash

# Verify kernel version and bridge multicast configuration
uname -r
bridge -d mdb show
bridge vlan global show

# Temporarily disable per-VLAN multicast snooping on affected bridge
ip link set dev br1 type bridge mcast_vlan_snooping 0