The Linux kernel’s bridge CFM module fails to validate the CCM transmit interval configured by a user through netlink. When the interval is set to an invalid value such as BR_CFM_CCM_INTERVAL_NONE or a value outside the permitted range, the interval conversion routine returns zero. This causes the delayed work handler to reschedule itself immediately, resulting in a tight loop that continuously allocates socket buffers until the system runs out of memory and the kernel terminates processes. The impact is a denial of service that can potentially bring the entire host to a halt.

This flaw exists in the Linux kernel’s bridge CFM implementation. All kernel releases that support bridge CFM without the post‑fix validation are affected; the exact version range is not specified in the advisory, so any kernel pre‑dating the commit that added the configuration‑time check is vulnerable.

It can be exploited only by a local user with sufficient privileges to adjust bridge CFM settings via netlink. Supplying an invalid CCM transmit interval that resolves to zero in the conversion routine causes the kernel’s delayed work handler to reschedule itself immediately, creating a tight loop that continuously allocates socket buffers until the system runs out of memory. The CVSS score of 5.5 reflects a medium‑severity denial‑of‑service impact. The EPSS score of less than 1 % indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires privileged access to netlink, the overall risk is limited to trusted or compromised local users.