CVE-2026-64537

Not scored yetLast modified Nov 3, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bridge: cfm: reject invalid CCM interval at configuration time

ccm_tx_work_expired() re-arms itself via queue_delayed_work() using the configured exp_interval converted by interval_to_us(). When exp_interval is BR_CFM_CCM_INTERVAL_NONE or out of range, interval_to_us() returns 0, causing the worker to fire immediately in a tight loop that allocates skbs until OOM.

Fix this by validating exp_interval at configuration time:

- Constrain IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL to the valid range [BR_CFM_CCM_INTERVAL_3_3_MS, BR_CFM_CCM_INTERVAL_10_MIN] in the netlink policy so userspace cannot set an invalid value.

- Reject starting CCM TX in br_cfm_cc_ccm_tx() when exp_interval has not yet been configured (defaults to 0 from kzalloc).

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 2be665c3940d367e0a2a8128eb4985ce323f99a3, < 2870056a78961e0fecd652362ee9d3fcfd24a8a6; >= 2be665c3940d367e0a2a8128eb4985ce323f99a3, < f0f5eb59a97ece0d85de8cfa95dc18c609302a8b; >= 2be665c3940d367e0a2a8128eb4985ce323f99a3, < 53788b134519e995699ea3721969c96a08d64575; >= 2be665c3940d367e0a2a8128eb4985ce323f99a3, < b42aeb58317f12024734759ff745856b53948873; >= 2be665c3940d367e0a2a8128eb4985ce323f99a3, < a090880c1f544589427e5b7050c40fb211ccecb4; >= 2be665c3940d367e0a2a8128eb4985ce323f99a3, < 865643640b5b5c4579b32d7a55ac9ad648362eaa; >= 2be665c3940d367e0a2a8128eb4985ce323f99a3, < f3e02edd8322b31b8e6517faa6ba053bf29d1e26
LinuxLinux5.11

References

Timeline

Published
Jul 27, 2026
Last modified
Nov 3, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-64538In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). fib6_nh_mtu_change()CVE-2026-645397.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eir_cCVE-2026-64546.4The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This isCVE-2026-645408.1In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() genelinkCVE-2026-645419.8In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdcCVE-2026-64542In the Linux kernel, the following vulnerability has been resolved: ipv6: ndisc: fix NULL deref in accept_untracked_na() accept_untracked_CVE-2026-645437.8In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() bearer_dCVE-2026-64544In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents peCVE-2026-645457.5In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdp_master_redirect() xdp_master_reCVE-2026-645467.1In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drm_parse_tiled_block() drm_parse_tiled_blocCVE-2026-645478.1In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packet_len before pad-byte access in rx_fixCVE-2026-645488.4In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() Whe
CVE-2026-64537: Unscored | Vulnix