PT-2026-61305 · Linux · Linux Kernel

CVE-2026-63988 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the bridge component where the brport store() function acquires the bridge lock for all attributes. This causes a problem when certain bridge port flags change, as the bridge calls dev set promiscuity(), a function that can sleep. Calling a sleeping function while holding a spinlock occurs in an atomic context, which can lead to a system crash or kernel panic (splat).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-63988

Affected Products

Linux Kernel

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-63988 · Security Note
• https://git.kernel.org/stable/c/2f9cb30d97e45686f3119fff3b30f12259950910 · Note
• https://twitter.com/infoflowcloud/status/2078862782204608821 · Twitter Post
• https://git.kernel.org/stable/c/6d34594cc619d0d4b07d5afcad8b5984f3526dcf · Note
• https://twitter.com/CVEnew/status/2078861468737376353 · Twitter Post
• https://git.kernel.org/stable/c/e976e3f2f2005c6267089a1a3b6344f234a59a55 · Note