Executive brief
A vulnerability in the Linux kernel's network bridging component could allow a local user to crash the system. By providing an invalid configuration value to the Media Redundancy Protocol (MRP) feature, an attacker can trigger an infinite loop that rapidly consumes all available system memory. This leads to a total system freeze or 'kernel panic,' disrupting all operations and services running on the affected machine.
Technical details
A denial-of-service vulnerability exists in the Linux kernel's bridge MRP (Media Redundancy Protocol) implementation within net/bridge/br_mrp_netlink.c. The functions br_mrp_start_test() and br_mrp_start_in_test() accept user-supplied interval values via netlink without validation. If an interval of zero is provided, usecs_to_jiffies(0) results in a zero-delay workqueue rescheduling loop. This tight loop on system_percpu_wq allocates and transmits MRP test frames at the maximum possible rate, leading to Out-Of-Memory (OOM) deadlocks and kernel panics. The fix implements NLA_POLICY_MIN(NLA_U32, 1) to enforce a minimum interval of 1 at the netlink parsing layer.
Affected products
- Linux Linux Kernel 5.8 to 6.19.12
Timeline
- 2026-03-27: other: Patch authored
- 2026-04-11: patched: Patch committed to stable tree
- 2026-04-13: disclosed: CVE published