Executive brief
The Linux kernel's Media Redundancy Protocol (MRP) implementation contains a use-after-free vulnerability in timer handling. An attacker could exploit this to cause a system crash or potentially execute code, disrupting network connectivity and system stability on affected devices.
Technical details
A use-after-free vulnerability exists in the MRP module (net/802/mrp.c) where the periodic timer can be restarted after its structure has been freed during applicant uninitialization. The vulnerability occurs because del_timer_sync() does not prevent timer restart, allowing a race condition where the timer fires and attempts to queue operations on already-freed memory. The fix introduces an active flag to prevent timer restart after deinitialization. The vulnerability is reachable via network-level MRP protocol handling and requires no authentication; a local attacker with network access can trigger the race condition.
Affected products
- Linux Linux kernel through 6.1.0-rc5 and potentially later
Timeline
- 2025-12-24: disclosed