CVE-2026-63989: Linux Kernel Race Condition Vulnerability

CVE-2026-63989 Overview

CVE-2026-63989 is a Linux kernel vulnerability in the bridge networking subsystem. The flaw exists in the netlink configuration path for bridge ports, specifically in the br_setport() function. When a netlink message triggers bridge port flag changes, the kernel calls dev_set_promiscuity() while holding the bridge spinlock. Since dev_set_promiscuity() can sleep, this produces a "sleeping function called from invalid context" bug.

The issue results in kernel warning splats and potential instability when userspace tools reconfigure bridge port attributes over netlink. The vulnerability affects Linux kernel bridge functionality used widely in virtualization, container networking, and general networking stacks.

Critical Impact
Local users with network configuration privileges can trigger kernel warnings and potential system instability by sending netlink messages that modify bridge port flags.

Affected Products

Linux kernel bridge subsystem (net/bridge/br_netlink.c)
Linux distributions shipping affected kernel versions
Systems using Linux bridges for virtualization, containers, or general networking

Discovery Timeline

2026-07-19 - CVE-2026-63989 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63989

Vulnerability Analysis

The vulnerability originates in the Linux bridge netlink configuration path. The br_setport() function historically ran under the bridge spinlock because it only processed three Spanning Tree Protocol (STP) attributes: cost, priority, and state. The bridge lock legitimately protects STP state.

Over time, br_setport() gained support for many additional attributes that do not require the bridge lock. These include bridge flags, forwarding database (FDB) port flushing, multicast attributes, group forward mask, backup port, and next-hop ID (NHID). Most of these paths need only the RTNL mutex or their own dedicated locks.

When a netlink client sets bridge port flags that toggle promiscuous mode, br_setport() calls br_port_flags_change(), which invokes dev_set_promiscuity(). That function became sleepable, so calling it under the bridge spinlock violates atomic-context rules and triggers a BUG: sleeping function called from invalid context warning at net/core/dev_addr_lists.c:1262.

Root Cause

The root cause is a locking scope regression. The bridge spinlock is held across the entire br_setport() function even though most attribute handlers no longer require it. When dev_set_promiscuity() transitioned to a sleeping implementation, the pre-existing lock scope became incompatible with the sleeping callee.

Attack Vector

The vulnerability requires local access with CAP_NET_ADMIN privileges to send netlink RTM_SETLINK messages targeting bridge ports. An attacker or misconfigured management daemon that toggles bridge port flags such as promiscuous-affecting flags will trigger the atomicity violation. The impact is limited to kernel warnings, degraded stability, and potential downstream locking issues rather than direct code execution.

The issue reproduces through standard bridge management tools that call the netlink br_setlink path. The vulnerability is not remotely exploitable and requires network administration privileges on the local host.

Detailed technical information is available in the upstream fix commits: Kernel Git Commit 5eec442, Kernel Git Commit 803d39, and Kernel Git Commit c9c2e6.

Detection Methods for CVE-2026-63989

Indicators of Compromise

Kernel log entries containing BUG: sleeping function called from invalid context at net/core/dev_addr_lists.c
Stack traces referencing br_setport, br_setlink, br_port_flags_change, br_manage_promisc, and dev_set_promiscuity
Kernel warnings referencing __might_resched triggered by the bridge process context

Detection Strategies

Monitor dmesg and /var/log/kern.log for in_atomic() splats originating from bridge netlink handling.
Audit running Linux kernel versions across the fleet to identify hosts running kernels without the referenced fix commits.
Correlate netlink RTM_SETLINK activity against bridge devices with subsequent kernel warnings.

Monitoring Recommendations

Ingest kernel logs into a centralized logging or SIEM platform and alert on BUG: sleeping function called patterns.
Track CAP_NET_ADMIN usage and bridge management activity on virtualization and container hosts.
Enable kernel lockdep and preemption debugging in test environments to surface similar locking regressions early.

How to Mitigate CVE-2026-63989

Immediate Actions Required

Identify all Linux hosts using bridge networking, especially hypervisors and container hosts, and prioritize them for kernel updates.
Apply vendor-provided kernel updates that incorporate the upstream fix commits reducing the bridge lock scope in br_setport().
Restrict CAP_NET_ADMIN and netlink socket access to trusted administrators and services.

Patch Information

The upstream fix reduces the scope of the bridge spinlock so that it is only held while processing the three STP-related attributes (cost, priority, and state) that actually require it. Other attribute handlers acquire their own appropriate locks. Fixes are available in the following upstream commits: Kernel Git Commit 5eec442, Kernel Git Commit 803d39, and Kernel Git Commit c9c2e6. Apply the corresponding stable kernel release from your distribution.

Workarounds

Avoid changing bridge port flags that affect promiscuous mode at runtime on unpatched kernels.
Limit the use of netlink-based bridge reconfiguration tools until vendor kernel updates are applied.
Restrict access to network configuration utilities to reduce the number of users who can trigger the code path.

bash

# Verify the running kernel version and confirm patched build is installed
uname -r

# Example: apply distribution kernel updates (Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r)

# Example: apply distribution kernel updates (RHEL/CentOS/Fedora)
sudo dnf update kernel

# Reboot to activate the patched kernel
sudo systemctl reboot