Executive brief
A technical issue was identified in the Linux kernel's network bridge component, which manages how different network segments communicate. Under specific conditions when changing network settings via the system interface, the kernel could attempt to perform a 'sleep' operation while in a restricted state that forbids it. This can lead to a system crash or instability (kernel panic), potentially causing a denial of service for the affected machine.
Technical details
A vulnerability exists in the Linux kernel bridge module where brport_store() incorrectly holds a spinlock (bridge lock) while calling functions that may sleep, specifically dev_set_promiscuity(). This occurs when certain bridge port flags are modified via sysfs. Holding a spinlock creates an atomic context where sleeping is prohibited; violating this leads to a kernel 'splat' or panic. The fix involves reducing the scope of the bridge lock to only protect STP-related attributes (cost and priority) and allowing other attributes to be processed without the lock. This issue was resolved in the stable kernel branches in June 2026.
Affected products
- Linux Linux Kernel All versions prior to the fix in 2026
Timeline
- 2026-05-26: disclosed: Initial patch submitted by Ido Schimmel
- 2026-06-09: patched: Patch committed to stable tree by Greg Kroah-Hartman
- 2026-07-19: advisory: CVE-2026-63988 published