The Linux kernel’s bridge MRP subsystem fails to validate a user‑supplied test interval received via netlink. When the interval is zero, the scheduled work loop reschedules itself with zero delay, initiating a nonstop allocation and transmission of MRP frames that consumes all system memory. The ensuing out‑of‑memory deadlock triggers a kernel panic, effectively denying system service. This flaw illustrates missing input validation (CWE‑606) and potential concurrent access issues (CWE‑667).

The vulnerability affects all Linux kernel releases that include the bridge MRP code without the applied patch. Specific version ranges are not enumerated, so any kernel older than the new commit that introduces a minimum value of 1 for the attributes IFLA_BRIDGE_MRP_START_TEST_INTERVAL and IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL is susceptible. Administrators should verify the kernel version or the presence of the updated NLA policy to determine exposure.

The CVSS score of 5.5 indicates a medium severity denial‑of‑service vulnerability, while the EPSS score of less than 1% suggests a very low, but nonzero, probability of exploitation. The flaw is not listed in the CISA KEV catalog. An attacker needs to send a netlink request to a bridge interface, typically requiring privileged or local access. When successful, the out‑of‑memory condition can bring the system down, representing a significant denial‑of‑service scenario. The attack vector is resident and likely limited to privileged or local users unless the host exposes the bridge netlink interface to untrusted parties. Given the lack of public exploits and the low exploitation probability, the overall risk is considered medium‑high for unpatched systems that rely on MRP testing.