CVE-2026-63988 - Vulnerability Details

- bridge: Fix sleep in atomic context in sysfs path

Description

In the Linux kernel, the following vulnerability has been resolved:

bridge: Fix sleep in atomic context in sysfs path

Since the start of the git history, brport_store() always acquired the
bridge lock. Back then this decision made sense: The bridge lock
protects the STP state of the bridge and its ports and at that time the
function was only used by two STP related attributes (cost and
priority).

Nowadays, brport_store() processes a lot more attributes and most of
them do not need the bridge lock:

* Bridge flags: Only require RTNL. Read locklessly by the data path.
Annotations can be added in net-next.

* FDB port flushing: Only requires the FDB lock.

* Multicast attributes: Only require the multicast lock.

* Group forward mask: Only requires RTNL. Read locklessly by the data
path. Annotations can be added in net-next.

* Backup port: Only requires RTNL. Read locklessly by the data path.

This is a problem as the bridge calls dev_set_promiscuity() when certain
bridge port flags change and this function can sleep since the commit
cited below, resulting in a splat such as [1].

Fix this by reducing the scope of the bridge lock and only take it when
processing the two STP related attributes that require it. Remove the
now stale comment from br_switchdev_set_port_flag(). The
SWITCHDEV_F_DEFER flag can be removed in net-next.

[1]
BUG: sleeping function called from invalid context at net/core/dev_addr_lists.c:1262
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 372, name: bash
preempt_count: 201, expected: 0
RCU nest depth: 0, expected: 0
5 locks held by bash/372:
#0: ffff88810c51c3f0 (sb_writers#7){.+.+}-{0:0}, at: ksys_write (fs/read_write.c:740)
#1: ffff888115ce9480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter (fs/kernfs/file.c:343)
#2: ffff88810b9fd330 (kn->active#37){.+.+}-{0:0}, at: kernfs_fop_write_iter (fs/kernfs/file.c:80 fs/kernfs/file.c:344)
#3: ffffffffa59473a0 (rtnl_mutex){+.+.}-{4:4}, at: brport_store (net/bridge/br_sysfs_if.c:326)
#4: ffff8881099d2d58 (&br->lock){+...}-{3:3}, at: brport_store (./include/linux/spinlock.h:348 net/bridge/br_sysfs_if.c:345)
Preemption disabled at:
0x0
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
__might_resched.cold (kernel/sched/core.c:9163)
netif_rx_mode_run (net/core/dev_addr_lists.c:1262)
netif_rx_mode_sync (net/core/dev_addr_lists.c:1428)
dev_set_promiscuity (net/core/dev_api.c:289)
br_manage_promisc (net/bridge/br_if.c:135 net/bridge/br_if.c:172)
br_port_flags_change (net/bridge/br_if.c:242 net/bridge/br_if.c:747)
store_learning (net/bridge/br_sysfs_if.c:79 net/bridge/br_sysfs_if.c:235)
brport_store (net/bridge/br_sysfs_if.c:346)
kernfs_fop_write_iter (fs/kernfs/file.c:352)
new_sync_write (fs/read_write.c:595)
vfs_write (fs/read_write.c:688)
ksys_write (fs/read_write.c:740)
do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

Published: 2026-07-19

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The issue occurs when a privileged user writes to bridge port sysfs attributes, causing the brport_store function to take a bridge lock that can sleep. In atomic context the sleep‑triggering call dev_set_promiscuity results in a kernel oops. The crash causes a loss of kernel availability, which is a denial of service. The weakness lies in misusing a blocking synchronization primitive (CWE-663).

Affected Systems

Any Linux kernel build that does not include the commit mentioned in the advisory is affected. This applies to all distributions that ship the unpatched mainline kernel, regardless of vendor or custom kernel version. The advisory does not list specific build numbers, so any kernel before the fix is at risk.

Risk and Exploitability

EPSS <1% shows a very low probability of public exploitation. The vulnerability is not listed in the CISA KEV catalog. The impact requires write access to bridge sysfs entries, so the exploit is limited to a local privileged user, usually root or a user with CAP_SYS_ADMIN. The typical attack vector is a local privileged user modifying a bridge sysfs attribute, leading to a kernel crash; no publicly available exploit is documented, so the overall risk remains low under normal circumstances.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`78cd408356fe3edbac66598772fd347bf3e32c1f`	affected	< e976e3f2f2005c6267089a1a3b6344f234a59a55
`78cd408356fe3edbac66598772fd347bf3e32c1f`	affected	< 2f9cb30d97e45686f3119fff3b30f12259950910
`78cd408356fe3edbac66598772fd347bf3e32c1f`	affected	< 6d34594cc619d0d4b07d5afcad8b5984f3526dcf

Linux

affected

Version	Status	Constraints
`6.15`	affected	—
`0`	unaffected	< 6.15
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[78cd408356fe3edbac66598772fd347bf3e32c1f,e976e3f2f2005c6267089a1a3b6344f234a59a55)`	affected	code_commit	—
`[78cd408356fe3edbac66598772fd347bf3e32c1f,2f9cb30d97e45686f3119fff3b30f12259950910)`	affected	code_commit	—
`[78cd408356fe3edbac66598772fd347bf3e32c1f,6d34594cc619d0d4b07d5afcad8b5984f3526dcf)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.15`	affected	generic	—
`[0,6.15)`	unaffected	generic	—
`[6.18.35,6.19.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel revision that incorporates the commit fixing the spinlock/atomic sleep issue.
Restrict write permissions on bridge sysfs files to privileged users only, ensuring they are owned by root and not writable by non‑privileged users.
Continuously monitor kernel logs for the “sleeping function called from invalid context” OOPS message, and verify system stability after any bridge configuration changes.

Generated by OpenCVE AI on August 4, 2026 at 06:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00166.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2f9cb30d97e45686f3119fff3b30f12259950910
https://git.kernel.org/stable/c/6d34594cc619d0d4b07d5afcad8b5984f3526dcf
https://git.kernel.org/stable/c/e976e3f2f2005c6267089a1a3b6344f234a59a55
https://lore.kernel.org/linux-cve-announce/2026071903-CVE-2026-63988-b641@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63988
https://www.cve.org/CVERecord?id=CVE-2026-63988

History

Mon, 27 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-658

Wed, 22 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-663
References		https://lore.kernel.org/linux-cve-announce/2026071903-CVE-2026-63988-b641@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63988 https://www.cve.org/CVERecord?id=CVE-2026-63988
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Tue, 21 Jul 2026 23:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-658

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: bridge: Fix sleep in atomic context in sysfs path Since the start of the git history, brport_store() always acquired the bridge lock. Back then this decision made sense: The bridge lock protects the STP state of the bridge and its ports and at that time the function was only used by two STP related attributes (cost and priority). Nowadays, brport_store() processes a lot more attributes and most of them do not need the bridge lock: * Bridge flags: Only require RTNL. Read locklessly by the data path. Annotations can be added in net-next. * FDB port flushing: Only requires the FDB lock. * Multicast attributes: Only require the multicast lock. * Group forward mask: Only requires RTNL. Read locklessly by the data path. Annotations can be added in net-next. * Backup port: Only requires RTNL. Read locklessly by the data path. This is a problem as the bridge calls dev_set_promiscuity() when certain bridge port flags change and this function can sleep since the commit cited below, resulting in a splat such as [1]. Fix this by reducing the scope of the bridge lock and only take it when processing the two STP related attributes that require it. Remove the now stale comment from br_switchdev_set_port_flag(). The SWITCHDEV_F_DEFER flag can be removed in net-next. [1] BUG: sleeping function called from invalid context at net/core/dev_addr_lists.c:1262 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 372, name: bash preempt_count: 201, expected: 0 RCU nest depth: 0, expected: 0 5 locks held by bash/372: #0: ffff88810c51c3f0 (sb_writers#7){.+.+}-{0:0}, at: ksys_write (fs/read_write.c:740) #1: ffff888115ce9480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter (fs/kernfs/file.c:343) #2: ffff88810b9fd330 (kn->active#37){.+.+}-{0:0}, at: kernfs_fop_write_iter (fs/kernfs/file.c:80 fs/kernfs/file.c:344) #3: ffffffffa59473a0 (rtnl_mutex){+.+.}-{4:4}, at: brport_store (net/bridge/br_sysfs_if.c:326) #4: ffff8881099d2d58 (&br->lock){+...}-{3:3}, at: brport_store (./include/linux/spinlock.h:348 net/bridge/br_sysfs_if.c:345) Preemption disabled at: 0x0 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) __might_resched.cold (kernel/sched/core.c:9163) netif_rx_mode_run (net/core/dev_addr_lists.c:1262) netif_rx_mode_sync (net/core/dev_addr_lists.c:1428) dev_set_promiscuity (net/core/dev_api.c:289) br_manage_promisc (net/bridge/br_if.c:135 net/bridge/br_if.c:172) br_port_flags_change (net/bridge/br_if.c:242 net/bridge/br_if.c:747) store_learning (net/bridge/br_sysfs_if.c:79 net/bridge/br_sysfs_if.c:235) brport_store (net/bridge/br_sysfs_if.c:346) kernfs_fop_write_iter (fs/kernfs/file.c:352) new_sync_write (fs/read_write.c:595) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Title		bridge: Fix sleep in atomic context in sysfs path
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2f9cb30d97e45686f3119fff3b30f12259950910 https://git.kernel.org/stable/c/6d34594cc619d0d4b07d5afcad8b5984f3526dcf https://git.kernel.org/stable/c/e976e3f2f2005c6267089a1a3b6344f234a59a55

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:56:09.677Z

Updated: 2026-07-19T14:56:09.677Z

Reserved: 2026-07-19T07:54:57.025Z

Link: CVE-2026-63988

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Low

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63988 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-04T06:30:05Z

Weaknesses

CWE-663
Use of a Non-reentrant Function in a Concurrent Context

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object