CVE-2026-63955 Overview
CVE-2026-63955 is a Linux kernel denial-of-service vulnerability in the virtual memory allocator subsystem (mm/vmalloc). The function __get_vm_area_node() triggers a BUG() when in_interrupt() returns true. However, in_interrupt() also reports true when bottom halves (BH) are merely disabled, not only in non-maskable interrupt (NMI) or hard interrupt request (IRQ) contexts. Bridge networking code paths call rhashtable_lookup_insert_fast() with BH disabled, which cascades into kvmalloc() and ultimately __get_vm_area_node(), causing an incorrect kernel panic. The fix replaces the overly broad in_interrupt() check with in_nmi() || in_hardirq().
Critical Impact
A network-reachable path through the Linux bridge subsystem can cause a kernel BUG() and denial of service on affected systems.
Affected Products
- Linux kernel (upstream, versions containing the __get_vm_area_node()in_interrupt() check)
- Distributions shipping the affected kernel prior to backport of commits 04aa71da5f35 and ad7eff07b625
- Systems using the Linux bridge subsystem with FDB (forwarding database) local entries
Discovery Timeline
- 2026-07-19 - CVE-2026-63955 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63955
Vulnerability Analysis
The vulnerability resides in __get_vm_area_node() within mm/vmalloc.c. This function historically guarded against allocations from interrupt context by invoking BUG_ON(in_interrupt()). The macro in_interrupt() returns true not only for NMI and hard IRQ contexts but also when soft IRQs or bottom halves are disabled. Legitimate callers that disable BH for locking purposes should be permitted to call vmalloc(), yet the guard treats them as illegal.
The Linux bridge code exercises this path routinely. When __vlan_add() invokes br_fdb_add_local(), it acquires br->hash_lock via spin_lock_bh(), disabling bottom halves. The subsequent call chain reaches rhashtable_lookup_insert_fast(), which allocates memory through kvmalloc(). Under sufficient allocation size or fallback conditions, kvmalloc() dispatches to vmalloc(), invoking __get_vm_area_node() and triggering the BUG().
The kernel BUG() macro emits a fatal exception, killing the offending task and often destabilizing the system. In production networking hosts, this results in service disruption.
Root Cause
The root cause is an over-broad context check [kernel vulnerability class]. in_interrupt() conflates several distinct execution contexts: NMI, hard IRQ, soft IRQ, and BH-disabled. Only the first two are genuinely incompatible with vmalloc()'s allocation semantics. Disabling BH is a common and legitimate synchronization pattern that should not preclude memory allocation.
Attack Vector
The attack vector is network-adjacent. An unauthenticated remote source can influence bridge FDB entry creation through VLAN and MAC learning operations on a bridged interface. Any code path that reaches fdb_create() under the br->hash_lock bottom-half-disabled critical section can trigger the kernel BUG(). Exploitation causes availability loss without disclosing data or granting code execution.
The fix, applied in upstream commits 04aa71da5f35aacdc9ae9cb5150947daa624f641 and ad7eff07b625f53c3fb513b30d7a8c5a79fbc7ce, replaces the in_interrupt() guard with in_nmi() || in_hardirq(), narrowing the check to contexts where vmalloc() genuinely cannot run.
Detection Methods for CVE-2026-63955
Indicators of Compromise
- Kernel panic messages referencing __get_vm_area_node and BUG_ON(in_interrupt()) in dmesg or /var/log/kern.log
- Stack traces containing rhashtable_lookup_insert_fast → kvmalloc_node → __vmalloc_node_range → __get_vm_area_node
- Unexpected bridge subsystem task terminations correlated with VLAN or FDB configuration changes
Detection Strategies
- Monitor kernel ring buffer for BUG: entries originating in mm/vmalloc.c and correlate with bridge (br_fdb) call frames
- Track unexpected reboots or task kills on hosts running Linux bridge with VLAN filtering enabled
- Compare running kernel version against distribution advisories referencing commits 04aa71da5f35 and ad7eff07b625
Monitoring Recommendations
- Ingest kernel logs into a centralized logging platform and alert on kernel BUG events referencing vmalloc
- Baseline bridge FDB churn to identify anomalous MAC-learning traffic that could drive the vulnerable path
- Track host uptime and kernel oops counters across Linux fleet to detect crash clusters
How to Mitigate CVE-2026-63955
Immediate Actions Required
- Inventory Linux hosts running the bridge subsystem, particularly hypervisors, container hosts, and network appliances
- Apply distribution kernel updates that incorporate the upstream fix replacing in_interrupt() with in_nmi() || in_hardirq()
- Restart affected hosts after patching to ensure the corrected kernel is loaded
Patch Information
The upstream fix is available in the mainline kernel via commits 04aa71da5f35 and ad7eff07b625. Consult your Linux distribution's security advisories for backported stable kernel releases and apply the vendor-supplied package.
Workarounds
- Restrict who can create, modify, or attach bridge interfaces and VLAN configurations to reduce exposure of the vulnerable code path
- Where feasible, avoid Linux bridge FDB local entry churn on untrusted network segments until the patched kernel is deployed
- Isolate multi-tenant workloads that share a bridged network namespace until the fix is applied
# Verify running kernel version and check for the fix
uname -r
# Debian/Ubuntu: install the latest kernel security update
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-generic
# RHEL/CentOS/Fedora: apply kernel updates
sudo dnf update kernel
# Reboot to load the patched kernel
sudo systemctl reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
