A Linux bridge is a kernel networking component that connects two or more interfaces at layer 2, forwarding Ethernet frames based on MAC addresses. It acts like a virtual switch inside the operating system, allowing traffic to pass between physical and virtual interfaces without routing at IP layer.
In cyber security, Linux bridges matter because they sit in a privileged part of the networking stack and often handle asynchronous features such as Spanning Tree Protocol, timers, and interface teardown. Bugs in this code can lead to packet interception, traffic disruption, or memory-safety flaws such as use-after-free. Defenders should treat bridge configuration as sensitive, keep kernels patched, and reduce exposure of unnecessary bridging and STP functionality.