Linux Kernel Bridge LAG State Check Vulnerability Causes Denial-of-Service Crash

A vulnerability in the Linux kernel's handling of bridge Layer Aggregation Group (LAG) devices can lead to a denial-of-service crash. This issue arises when a LAG device is removed from a bridge, triggering a NETDEV_CHANGEUPPER event. The driver attempts to flush offloaded entries by checking the status of lower devices. If one of the Physical Functions (PFs) is unloaded, the check fails, causing the flush to be skipped. Meanwhile, the bridge's Forwarding Database (FDB) entry remains active, prompting the driver to repeatedly send update events. This cycle eventually crashes the system by accessing a bond netdev that has already been destroyed.

Impact

The vulnerability causes a system crash by accessing a destroyed network device, disrupting normal operations and potentially leading to a system failure.