bridge: cfm: reject invalid CCM interval at configuration time
In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configuration time ccm_tx_work_expired() re-arms itself via queue_delayed_work() using the configured exp_interval converted by interval_to_us(). When exp_interval is BR_CFM_CCM_INTERVAL_NONE or out of range, interval_to_us() returns 0, causing the worker to fire immediately in a tight loop that allocates skbs until OOM. Fix this by validating exp_interval at configuration time: - Constrain IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL to the valid range [BR_CFM_CCM_INTERVAL_3_3_MS, BR_CFM_CCM_INTERVAL_10_MIN] in the netlink policy so userspace cannot set an invalid value. - Reject starting CCM TX in br_cfm_cc_ccm_tx() when exp_interval has not yet been configured (defaults to 0 from kzalloc).
CVE-2026-64537
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:CVE-2026-64537
Kernel
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 5.15.212
Source reference:
/affected/1/ranges6.1.178Source reference:
/affected/1/ranges6.6.145Source reference:
/affected/1/ranges6.12.97Source reference:
/affected/1/ranges6.18.40Source reference:
/affected/1/ranges7.1.5Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "2be665c3940d367e0a2a8128eb4985ce323f99a3"
},
{
"fixed": "2870056a78961e0fecd652362ee9d3fcfd24a8a6"
},
{
"fixed": "f0f5eb59a97ece0d85de8cfa95dc18c609302a8b"
},
{
"fixed": "53788b134519e995699ea3721969c96a08d64575"
},
{
"fixed": "b42aeb58317f12024734759ff745856b53948873"
},
{
"fixed": "a090880c1f544589427e5b7050c40fb211ccecb4"
},
{
"fixed": "865643640b5b5c4579b32d7a55ac9ad648362eaa"
},
{
"fixed": "f3e02edd8322b31b8e6517faa6ba053bf29d1e26"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64537.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.212"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.178"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.145"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.97"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.40"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.1.5"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64537.json"
}
}
]- Related CVEs
- CVE-2026-64537
Source reference:
/id
Publisher severity
No explicit severity was provided.
- Event
- #50680 · Revision 1
- Added to Heist Feed
- Publisher date