CVE-2026-63988: Linux Kernel Race Condition Vulnerability

CVE-2026-63988 Overview

CVE-2026-63988 is a Linux kernel vulnerability in the bridge networking subsystem. The flaw resides in the brport_store() function in net/bridge/br_sysfs_if.c, which unnecessarily acquires the bridge spinlock for all sysfs attribute writes. When certain bridge port flags change, the kernel calls dev_set_promiscuity(), which can sleep. Sleeping while holding a spinlock triggers a sleeping function called from invalid context bug, producing a kernel splat and potential system instability.

The issue affects the Linux kernel bridge driver used on any host that configures Linux software bridges via /sys/class/net/*/brif/*/.

Critical Impact
Local users with permission to write bridge port sysfs attributes can trigger a sleep-in-atomic-context condition, leading to kernel warnings and potential denial of service on affected Linux systems.

Affected Products

Linux kernel bridge subsystem (net/bridge/br_sysfs_if.c)
Linux distributions shipping vulnerable kernel versions prior to the fix commits
Systems using Linux software bridges with sysfs configuration interfaces

Discovery Timeline

2026-07-19 - CVE-2026-63988 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63988

Vulnerability Analysis

The vulnerability is a race condition and locking defect [CWE-667] in the Linux bridge driver's sysfs interface. Since the initial git history, brport_store() always acquired the bridge lock (&br->lock), a spinlock originally intended to protect Spanning Tree Protocol (STP) state for the bridge and its ports. At that time, the function handled only two STP-related attributes: cost and priority.

The function now processes many more attributes, most of which do not require the bridge spinlock. Bridge flags, forwarding database (FDB) port flushing, multicast attributes, group forward mask, and backup port assignments each rely on different synchronization primitives such as RTNL, the FDB lock, or the multicast lock.

The defect became a functional bug when dev_set_promiscuity() was changed to be sleepable. Certain bridge port flag changes call this function through br_manage_promisc(). Sleeping while holding the &br->lock spinlock violates atomic-context rules and produces a BUG: sleeping function called from invalid context at net/core/dev_addr_lists.c:1262 warning.

Root Cause

The root cause is over-broad lock scope. brport_store() unconditionally acquires the bridge spinlock for every attribute write, even for attributes whose handlers may sleep. Handlers such as store_learning invoke br_port_flags_change(), which triggers promiscuity changes requiring blocking memory allocations and mutex acquisition downstream in netif_rx_mode_run().

Attack Vector

A local user with write access to bridge port sysfs files under /sys/class/net/<bridge>/brif/<port>/ can trigger the condition by writing to attributes that toggle bridge port flags such as learning. This produces kernel warnings, may cause preemption imbalance, and can destabilize the system. Exploitation requires the CAP_NET_ADMIN capability in the relevant namespace.

The vulnerability mechanism is described in the upstream commit messages. See the Kernel Git Commit Update for the authoritative patch and technical explanation.

Detection Methods for CVE-2026-63988

Indicators of Compromise

Kernel log entries containing BUG: sleeping function called from invalid context at net/core/dev_addr_lists.c
Stack traces referencing brport_store, br_manage_promisc, dev_set_promiscuity, and __might_resched
preempt_count warnings emitted during writes to /sys/class/net/*/brif/*/ attributes

Detection Strategies

Monitor dmesg and /var/log/kern.log for __might_resched warnings tied to the bridge subsystem
Audit kernel version against the fix commits 2f9cb30d97e4, 6d34594cc619, and e976e3f2f200 to determine exposure
Track processes writing to bridge port sysfs files, correlating writes to learning, flush, and multicast attributes with subsequent kernel warnings

Monitoring Recommendations

Forward kernel ring buffer events to a centralized logging platform and alert on sleeping function called from invalid context patterns
Enable CONFIG_DEBUG_ATOMIC_SLEEP on test kernels to surface latent atomic-context violations before production rollout
Baseline expected callers of brport_store and flag anomalous write frequency to bridge port attributes

How to Mitigate CVE-2026-63988

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the fix commits 2f9cb30d97e4, 6d34594cc619, and e976e3f2f200
Update to a distribution kernel that incorporates the bridge sysfs locking fix
Restrict write access to bridge port sysfs attributes to trusted administrators only

Patch Information

The fix reduces the scope of the bridge spinlock so it is acquired only when processing the two STP-related attributes that require it (cost and priority). Other attribute handlers now rely on their appropriate synchronization primitives such as RTNL, the FDB lock, or the multicast lock. A stale comment in br_switchdev_set_port_flag() was removed, and the SWITCHDEV_F_DEFER flag was noted for later removal. The patch is available across the stable kernel trees via the Kernel Git Commit Update.

Workarounds

Limit CAP_NET_ADMIN privileges and container capabilities that permit writing to bridge sysfs interfaces
Prefer ip link set and bridge link netlink-based tools over sysfs writes to reduce exposure to affected code paths
Where feasible, avoid dynamic runtime changes to bridge port learning and related flags until the fixed kernel is deployed

bash

# Verify running kernel version and check for the fix
uname -r

# Confirm the bridge module is loaded
lsmod | grep bridge

# Restrict write access to bridge port sysfs attributes
find /sys/class/net/*/brif/ -type f -exec chmod 600 {} \;