CVE-2026-64537

bridge: cfm: reject invalid CCM interval at configuration time

State: Published
Severity: Not scored
Published: Jul 27, 2026
Updated: Aug 17, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bridge: cfm: reject invalid CCM interval at configuration time

ccm_tx_work_expired() re-arms itself via queue_delayed_work() using the configured exp_interval converted by interval_to_us(). When exp_interval is BR_CFM_CCM_INTERVAL_NONE or out of range, interval_to_us() returns 0, causing the worker to fire immediately in a tight loop that allocates skbs until OOM.

Fix this by validating exp_interval at configuration time:

- Constrain IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL to the valid range [BR_CFM_CCM_INTERVAL_3_3_MS, BR_CFM_CCM_INTERVAL_10_MIN] in the netlink policy so userspace cannot set an invalid value.

- Reject starting CCM TX in br_cfm_cc_ccm_tx() when exp_interval has not yet been configured (defaults to 0 from kzalloc).

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2be665c3940d367e0a2a8128eb4985ce323f99a3 to before 2870056a78961e0fecd652362ee9d3fcfd24a8a6Affected 2be665c3940d367e0a2a8128eb4985ce323f99a3 to before f0f5eb59a97ece0d85de8cfa95dc18c609302a8bAffected 2be665c3940d367e0a2a8128eb4985ce323f99a3 to before 53788b134519e995699ea3721969c96a08d64575Affected 2be665c3940d367e0a2a8128eb4985ce323f99a3 to before b42aeb58317f12024734759ff745856b53948873Affected 2be665c3940d367e0a2a8128eb4985ce323f99a3 to before a090880c1f544589427e5b7050c40fb211ccecb4Affected 2be665c3940d367e0a2a8128eb4985ce323f99a3 to before 865643640b5b5c4579b32d7a55ac9ad648362eaaAffected 2be665c3940d367e0a2a8128eb4985ce323f99a3 to before f3e02edd8322b31b8e6517faa6ba053bf29d1e26Affected
LinuxLinux	5.11Affected before 5.11Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

2be665c3940d367e0a2a8128eb4985ce323f99a3 to before 2870056a78961e0fecd652362ee9d3fcfd24a8a6Affected
2be665c3940d367e0a2a8128eb4985ce323f99a3 to before f0f5eb59a97ece0d85de8cfa95dc18c609302a8bAffected
2be665c3940d367e0a2a8128eb4985ce323f99a3 to before 53788b134519e995699ea3721969c96a08d64575Affected
2be665c3940d367e0a2a8128eb4985ce323f99a3 to before b42aeb58317f12024734759ff745856b53948873Affected
2be665c3940d367e0a2a8128eb4985ce323f99a3 to before a090880c1f544589427e5b7050c40fb211ccecb4Affected
2be665c3940d367e0a2a8128eb4985ce323f99a3 to before 865643640b5b5c4579b32d7a55ac9ad648362eaaAffected
2be665c3940d367e0a2a8128eb4985ce323f99a3 to before f3e02edd8322b31b8e6517faa6ba053bf29d1e26Affected

LinuxLinux

5.11Affected
before 5.11Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.