CVE-2026-31420

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bridge: mrp: reject zero test interval to avoid OOM panic

br_mrp_start_test() and br_mrp_start_in_test() accept the user-supplied

interval value from netlink without validation. When interval is 0,

usecs_to_jiffies(0) yields 0, causing the delayed work

(br_mrp_test_work_expired / br_mrp_in_test_work_expired) to reschedule

itself with zero delay. This creates a tight loop on system_percpu_wq

that allocates and transmits MRP test frames at maximum rate, exhausting

all system memory and causing a kernel panic via OOM deadlock.

The same zero-interval issue applies to br_mrp_start_in_test_parse()

for interconnect test frames.

Use NLA_POLICY_MIN(NLA_U32, 1) in the nla_policy tables for both

IFLA_BRIDGE_MRP_START_TEST_INTERVAL and

IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL, so zero is rejected at the

netlink attribute parsing layer before the value ever reaches the

workqueue scheduling code. This is consistent with how other

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References