CVE-2026-64537

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bridge: cfm: reject invalid CCM interval at configuration time

ccm_tx_work_expired() re-arms itself via queue_delayed_work() using

the configured exp_interval converted by interval_to_us(). When

exp_interval is BR_CFM_CCM_INTERVAL_NONE or out of range,

interval_to_us() returns 0, causing the worker to fire immediately in

a tight loop that allocates skbs until OOM.

Fix this by validating exp_interval at configuration time:

- Constrain IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL to the valid range

[BR_CFM_CCM_INTERVAL_3_3_MS, BR_CFM_CCM_INTERVAL_10_MIN] in the

netlink policy so userspace cannot set an invalid value.

- Reject starting CCM TX in br_cfm_cc_ccm_tx() when exp_interval has

not yet been configured (defaults to 0 from kzalloc).

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References