Linux kernel before 2.6.12 allows remote attackers to poison the bridge forwarding table using frames that have already been dropped by filtering, which can cause the bridge to forward spoofed packets.
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10157
http://www.securityfocus.com/bid/15536
http://www.redhat.com/support/errata/RHSA-2006-0493.html
http://www.mandriva.com/security/advisories?name=MDKSA-2007:025
http://www.debian.org/security/2005/dsa-922
http://support.avaya.com/elmodocs2/security/ASA-2006-161.htm
http://secunia.com/advisories/21745
http://secunia.com/advisories/20237
http://secunia.com/advisories/18056
http://linux.bkbits.net:8080/linux-2.6/cset%40429a310bRFOXOmZvKaGXW8A5Qd9F1A