CVE-2026-64537: CFM Bridge DDOS via invalid CCM interval in Linux kernel
CVE-2026-64537 Published on July 27, 2026
bridge: cfm: reject invalid CCM interval at configuration time
In the Linux kernel, the following vulnerability has been resolved:
bridge: cfm: reject invalid CCM interval at configuration time
ccm_tx_work_expired() re-arms itself via queue_delayed_work() using
the configured exp_interval converted by interval_to_us(). When
exp_interval is BR_CFM_CCM_INTERVAL_NONE or out of range,
interval_to_us() returns 0, causing the worker to fire immediately in
a tight loop that allocates skbs until OOM.
Fix this by validating exp_interval at configuration time:
- Constrain IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL to the valid range
[BR_CFM_CCM_INTERVAL_3_3_MS, BR_CFM_CCM_INTERVAL_10_MIN] in the
netlink policy so userspace cannot set an invalid value.
- Reject starting CCM TX in br_cfm_cc_ccm_tx() when exp_interval has
not yet been configured (defaults to 0 from kzalloc).
Products Associated with CVE-2026-64537
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 2be665c3940d367e0a2a8128eb4985ce323f99a3 and below 2870056a78961e0fecd652362ee9d3fcfd24a8a6 is affected.
- Version 2be665c3940d367e0a2a8128eb4985ce323f99a3 and below f0f5eb59a97ece0d85de8cfa95dc18c609302a8b is affected.
- Version 2be665c3940d367e0a2a8128eb4985ce323f99a3 and below 53788b134519e995699ea3721969c96a08d64575 is affected.
- Version 2be665c3940d367e0a2a8128eb4985ce323f99a3 and below b42aeb58317f12024734759ff745856b53948873 is affected.
- Version 2be665c3940d367e0a2a8128eb4985ce323f99a3 and below a090880c1f544589427e5b7050c40fb211ccecb4 is affected.
- Version 2be665c3940d367e0a2a8128eb4985ce323f99a3 and below 865643640b5b5c4579b32d7a55ac9ad648362eaa is affected.
- Version 2be665c3940d367e0a2a8128eb4985ce323f99a3 and below f3e02edd8322b31b8e6517faa6ba053bf29d1e26 is affected.
- Version 5.11 is affected.
- Before 5.11 is unaffected.
- Version 5.15.212, <= 5.15.* is unaffected.
- Version 6.1.178, <= 6.1.* is unaffected.
- Version 6.6.145, <= 6.6.* is unaffected.
- Version 6.12.97, <= 6.12.* is unaffected.
- Version 6.18.40, <= 6.18.* is unaffected.
- Version 7.1.5, <= 7.1.* is unaffected.
- Version 7.2-rc1, <= * is unaffected.