« Volver al listado

CVE-2026-64537

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

bridge: cfm: reject invalid CCM interval at configuration time

ccm_tx_work_expired() re-arms itself via queue_delayed_work() using the configured exp_interval converted by interval_to_us(). When exp_interval is BR_CFM_CCM_INTERVAL_NONE or out of range, interval_to_us() returns 0, causing the worker to fire immediately in a tight loop that allocates skbs until OOM.

Fix this by validating exp_interval at configuration time:

Detalles técnicos trazas, registros y código del informe original
 - Constrain IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL to the valid range
   [BR_CFM_CCM_INTERVAL_3_3_MS, BR_CFM_CCM_INTERVAL_10_MIN] in the
   netlink policy so userspace cannot set an invalid value.

 - Reject starting CCM TX in br_cfm_cc_ccm_tx() when exp_interval has
   not yet been configured (defaults to 0 from kzalloc).

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-64537",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2be665c3940d367e0a2a8128eb4985ce323f99a3",
              "lessThan": "2870056a78961e0fecd652362ee9d3fcfd24a8a6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2be665c3940d367e0a2a8128eb4985ce323f99a3",
              "lessThan": "f0f5eb59a97ece0d85de8cfa95dc18c609302a8b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2be665c3940d367e0a2a8128eb4985ce323f99a3",
              "lessThan": "53788b134519e995699ea3721969c96a08d64575",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2be665c3940d367e0a2a8128eb4985ce323f99a3",
              "lessThan": "b42aeb58317f12024734759ff745856b53948873",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2be665c3940d367e0a2a8128eb4985ce323f99a3",
              "lessThan": "a090880c1f544589427e5b7050c40fb211ccecb4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2be665c3940d367e0a2a8128eb4985ce323f99a3",
              "lessThan": "865643640b5b5c4579b32d7a55ac9ad648362eaa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2be665c3940d367e0a2a8128eb4985ce323f99a3",
              "lessThan": "f3e02edd8322b31b8e6517faa6ba053bf29d1e26",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/bridge/br_cfm.c",
            "net/bridge/br_cfm_netlink.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.11",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/bridge/br_cfm.c",
            "net/bridge/br_cfm_netlink.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-07-27T21:17:05.987",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2870056a78961e0fecd652362ee9d3fcfd24a8a6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/53788b134519e995699ea3721969c96a08d64575",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/865643640b5b5c4579b32d7a55ac9ad648362eaa",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a090880c1f544589427e5b7050c40fb211ccecb4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b42aeb58317f12024734759ff745856b53948873",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f0f5eb59a97ece0d85de8cfa95dc18c609302a8b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f3e02edd8322b31b8e6517faa6ba053bf29d1e26",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: cfm: reject invalid CCM interval at configuration time\n\nccm_tx_work_expired() re-arms itself via queue_delayed_work() using\nthe configured exp_interval converted by interval_to_us(). When\nexp_interval is BR_CFM_CCM_INTERVAL_NONE or out of range,\ninterval_to_us() returns 0, causing the worker to fire immediately in\na tight loop that allocates skbs until OOM.\n\nFix this by validating exp_interval at configuration time:\n\n - Constrain IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL to the valid range\n   [BR_CFM_CCM_INTERVAL_3_3_MS, BR_CFM_CCM_INTERVAL_10_MIN] in the\n   netlink policy so userspace cannot set an invalid value.\n\n - Reject starting CCM TX in br_cfm_cc_ccm_tx() when exp_interval has\n   not yet been configured (defaults to 0 from kzalloc)."
    }
  ],
  "lastModified": "2026-08-17T05:17:58.630",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}