Junglewise Threat Intelligence

CVE-2026-64537: Linux Kernel denial of service in bridge CFM CCM interval configuration

CVE-2026-64537 · Severity: info · Published 2026-07-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was discovered in the Linux kernel's network bridging component, specifically within the Connectivity Fault Management (CFM) feature. By providing an invalid configuration value for the messaging interval, a local user could trigger an infinite loop that rapidly consumes system memory. This can lead to a complete system crash or a denial-of-service (OOM) condition, impacting the availability of the server or network device.

Technical details

A vulnerability exists in the Linux kernel bridge CFM (Connectivity Fault Management) implementation where `ccm_tx_work_expired()` re-arms itself using a delay of 0 if the configured `exp_interval` is invalid or out of range. This occurs because `interval_to_us()` returns 0 for `BR_CFM_CCM_INTERVAL_NONE` or other invalid values, causing `queue_delayed_work()` to fire immediately in a tight loop. This loop continuously allocates socket buffers (skbs) until the system reaches an Out-of-Memory (OOM) state. The fix introduces range validation in the netlink policy for `IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL` and rejects CCM transmission starts if the interval is unconfigured.

Affected products

  • Linux Linux Kernel 5.11 to 5.15.212, 6.1.178, 6.6.74, 6.12.11, 6.13.1

Timeline

  • 2026-06-08: disclosed: Initial patch submission by Xiang Mei
  • 2026-07-24: patched: Patch committed to stable trees
  • 2026-07-27: advisory: CVE published to NVD dataset

References

Related threats