Linux bridge MST bypasses blocking without VLAN filtering

A configuration mismatch in the Linux kernel bridge lets Multiple Spanning Tree (MST) forward traffic on ports that should be blocked whenever VLAN filtering is turned off, defeating STP and MRP loop protection. The issue is tracked as CVE-2025-40297.

Cheng Yongkang reported that MST can be enabled with VLAN filtering disabled and no port VLAN entries present. The bridge still treats MST as active, so ingress skips the usual port-state check and both ingress and egress paths accept unfiltered frames. A port left in the blocking state therefore forwards data in both directions.

The bypass is deterministic rather than a race. Yongkang observed it on current kernels with vlan_filtering off, default PVID zero, MST on, and a port whose state read back as blocking: three matching broadcast frames crossed each way with MST enabled and none with it disabled.

A prior change under the same CVE closed a related use-after-free by tightening a lifetime check, but left the data-plane forwarding path open. The MST fast path needs to require both MST and VLAN filtering, and the bridge should refuse an MST configuration that is unusable without VLAN filtering.