Executive brief
A vulnerability in the Linux kernel's memory management system could cause a system crash (kernel panic) under specific networking conditions. This occurs when certain bridge networking operations attempt to allocate memory while 'bottom halves' are disabled, incorrectly triggering a critical error check. An exploit or even normal heavy network usage could lead to a complete service outage by forcing the operating system to shut down unexpectedly.
Technical details
A vulnerability in mm/vmalloc.c exists where __get_vm_area_node() incorrectly triggers a BUG_ON(in_interrupt()) when bottom halves (BH) are disabled. While in_interrupt() returns true when BH are disabled, this context does not necessarily imply a hard IRQ or NMI context where vmalloc would be unsafe. The issue is reachable via the bridge code path (e.g., __vlan_add() calling br_fdb_add_local()) which acquires a spinlock that disables BH before eventually calling vmalloc(). This results in a kernel panic (DoS). The fix replaces the overly broad in_interrupt() check with specific checks for in_nmi() or in_hardirq().
Affected products
- Linux Linux Kernel 6.19, 7.0.12, 7.1
Timeline
- 2026-05-15: disclosed: Initial patch submitted by Uladzislau Rezki
- 2026-07-19: advisory: CVE published in NVD dataset