PT-2026-65212 · Linux · Linux

CVE-2026-64537 · Published 2026-07-27 · Updated 2026-07-27

Mitre

In the Linux kernel, the following vulnerability has been resolved:

bridge: cfm: reject invalid CCM interval at configuration time

ccm tx work expired() re-arms itself via queue delayed work() using the configured exp interval converted by interval to us(). When exp interval is BR CFM CCM INTERVAL NONE or out of range, interval to us() returns 0, causing the worker to fire immediately in a tight loop that allocates skbs until OOM.

Fix this by validating exp interval at configuration time:

• Constrain IFLA BRIDGE CFM CC CONFIG EXP INTERVAL to the valid range [BR CFM CCM INTERVAL 3 3 MS, BR CFM CCM INTERVAL 10 MIN] in the netlink policy so userspace cannot set an invalid value.
• Reject starting CCM TX in br cfm cc ccm tx() when exp interval has not yet been configured (defaults to 0 from kzalloc).

Related Identifiers

CVE-2026-64537

Affected Products

Linux

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-64537 · Security Note
• https://git.kernel.org/stable/c/a090880c1f544589427e5b7050c40fb211ccecb4 · Note
• https://git.kernel.org/stable/c/b42aeb58317f12024734759ff745856b53948873 · Note
• https://git.kernel.org/stable/c/f3e02edd8322b31b8e6517faa6ba053bf29d1e26 · Note
• https://git.kernel.org/stable/c/f0f5eb59a97ece0d85de8cfa95dc18c609302a8b · Note
• https://git.kernel.org/stable/c/2870056a78961e0fecd652362ee9d3fcfd24a8a6 · Note
• https://git.kernel.org/stable/c/53788b134519e995699ea3721969c96a08d64575 · Note
• https://git.kernel.org/stable/c/865643640b5b5c4579b32d7a55ac9ad648362eaa · Note