CVE-2026-63989 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
bridge: Fix sleep in atomic context in netlink path
Since the introduction of the netlink configuration path for bridge ports in commit 25c71c75ac87 ("bridge: bridge port parameters over netlink"), br_setport() was always called with the bridge lock held around it. Back then this decision made sense: The bridge lock protects the STP state of the bridge and its ports and at that time the function only processed three STP related netlink attributes (cost, priority and state).
Nowadays, br_setport() processes a lot more attributes and most of them do not need the bridge lock:
* Bridge flags: Only require RTNL. Read locklessly by the data path. Annotations can be added in net-next.
* FDB port flushing: Only requires the FDB lock.
* Multicast attributes: Only require the multicast lock.
* Group forward mask: Only requires RTNL. Read locklessly by the data path. Annotations can be added in net-next.
* Backup port and NHID: Only require RTNL. Read locklessly by the data path.
This is a problem as the bridge calls dev_set_promiscuity() when certain bridge port flags change and this function can sleep since the commit cited below, resulting in a splat such as [1].
Fix this by reducing the scope of the bridge lock and only take it when processing the three STP related attributes that require it. This is consistent with the multicast attributes where each attribute acquires the multicast lock instead of having one critical section for all relevant attributes.
[1]
BUG: sleeping function called from invalid context at net/core/dev_addr_lists.c:1262 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 356, name: bridge preempt_count: 201, expected: 0 RCU nest depth: 0, expected: 0 2 locks held by bridge/356: #0: ffffffff919473a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg (net/core/rtnetlink.c:80 net/core/rtnetlink.c:7002)
#1: ffff888115072d58 (&br->lock){+...}-{3:3}, at: br_setlink (./include/linux/spinlock.h:348 net/bridge/br_netlink.c:1117)
Preemption disabled at: 0x0 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) __might_resched.cold (kernel/sched/core.c:9163) netif_rx_mode_run (net/core/dev_addr_lists.c:1262) netif_rx_mode_sync (net/core/dev_addr_lists.c:1428) dev_set_promiscuity (net/core/dev_api.c:289) br_manage_promisc (net/bridge/br_if.c:135 net/bridge/br_if.c:172) br_port_flags_change (net/bridge/br_if.c:242 net/bridge/br_if.c:747) br_setport (net/bridge/br_netlink.c:1000) br_setlink (net/bridge/br_netlink.c:1118) rtnl_bridge_setlink (net/core/rtnetlink.c:5572) rtnetlink_rcv_msg (net/core/rtnetlink.c:7005) netlink_rcv_skb (net/netlink/af_netlink.c:2550) netlink_unicast (net/netlink/af_netlink.c:1318 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) __sock_sendmsg (net/socket.c:787 (discriminator 4) net/socket.c:802 (discriminator 4)) ____sys_sendmsg (net/socket.c:2698) ___sys_sendmsg (net/socket.c:2752) __sys_sendmsg (net/socket.c:2784) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability described in this CVE relates to a critical flaw in the Linux kernel's bridge networking implementation that results in a system crash due to improper locking mechanisms during netlink configuration operations. This issue specifically affects the bridge subsystem where network configuration changes are processed through netlink sockets, creating a scenario where sleeping functions are invoked from atomic contexts. The root cause stems from an overly broad acquisition of the bridge lock during port parameter updates, which was initially justified for protecting STP state but has since become problematic as the functionality expanded.
The technical flaw manifests when br_setport() function processes various bridge attributes that no longer require the exclusive bridge lock, yet the current implementation maintains it throughout the entire execution. This is particularly problematic because certain operations within this function, such as those involving bridge port flags changes, trigger calls to dev_set_promiscuity(), a function that can sleep and therefore cannot be executed in atomic contexts. The kernel's runtime integrity check at net/core/dev_addr_lists.c:1262 detects this violation and generates a splat error, indicating that sleeping functions were called from invalid contexts where preemption is disabled.
This vulnerability directly impacts system stability and can lead to kernel oopses and system crashes, particularly when bridge port configurations are modified through netlink interfaces. The issue violates fundamental kernel design principles around atomic context usage and proper locking scope management. From a cybersecurity perspective, this represents a denial-of-service vector that could be exploited by malicious actors to destabilize network services running on Linux systems with bridge functionality. The problem is exacerbated by the fact that the fix requires careful re-evaluation of lock acquisition scopes, as demonstrated in the patch that reduces the bridge lock scope to only cover STP-related attributes while allowing other configuration parameters to proceed without holding the expensive bridge lock.
The operational impact extends beyond simple system crashes to include potential network connectivity disruptions in environments heavily reliant on bridge networking for virtualization or network segmentation. The fix aligns with established best practices in kernel development, specifically addressing improper locking patterns that could violate the principle of minimal lock scope and atomic context requirements. This vulnerability demonstrates how seemingly minor architectural decisions in kernel code can cascade into serious stability issues as functionality expands over time.
This issue relates to multiple CWE categories including CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), CWE-758 (Reliance on Undefined, Unspecified, or Implementation-Defined Behavior), and CWE-121 (Stack-based Buffer Overflow). The problem also intersects with ATT&CK techniques related to privilege escalation and system stability compromise through kernel-level vulnerabilities. The resolution involves implementing proper lock discipline where each attribute type acquires only the necessary locks, consistent with how multicast attributes are currently handled in the same codebase, thereby reducing contention and eliminating atomic context violations while maintaining data consistency for STP-related operations that actually require the bridge lock.