CVE-2026-63955
Received Received - Intake

Kernel BUG() Trigger in vmalloc Due to BH Disabled Context

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: do not trigger BUG() on BH disabled context __get_vm_area_node() currently triggers a BUG() if in_interrupt() returns true. However, in_interrupt() also reports true when BH are disabled. The bridge code can call rhashtable_lookup_insert_fast() with bottom halves disabled: __vlan_add() -> br_fdb_add_local() spin_lock_bh(&br->hash_lock); <-- Disable BH -> fdb_add_local() -> fdb_create() -> rhashtable_lookup_insert_fast() -> kvmalloc() -> vmalloc() -> __get_vm_area_node() -> BUG_ON(in_interrupt()) spin_unlock_bh(&br->hash_lock) this triggers the BUG() despite the caller not being in NMI or hard IRQ context. Replace the in_interrupt() check with in_nmi() || in_hardirq().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63955
EUVD
EUVD-2026-45728

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a bug in the mm/vmalloc module. The function __get_vm_area_node() incorrectly triggers a BUG() condition when bottom halves (BH) are disabled, not just during non-maskable interrupts (NMI) or hard IRQ contexts. This happens because in_interrupt() returns true when BH are disabled, leading to an unintended system crash.

Detection Guidance

This vulnerability triggers a kernel BUG() when BH (bottom halves) are disabled during memory allocation in the bridge code. Detection requires checking kernel logs for BUG() traces or crashes related to vmalloc or bridge operations. Monitor logs with: dmesg | grep -i 'BUG\|vmalloc\|bridge' or journalctl -k | grep -i 'BUG\|vmalloc\|bridge'.

Impact Analysis

This vulnerability can cause the Linux kernel to crash unexpectedly when certain network bridge operations are performed. Specifically, if a system uses Linux kernel network bridging features, it may trigger a kernel panic during operations like adding VLANs, leading to system downtime and potential data loss.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a Linux kernel bug related to memory allocation in interrupt contexts. Compliance impact would depend on system-specific configurations and usage rather than the vulnerability itself.

Mitigation Strategies

Apply the Linux kernel patch that replaces in_interrupt() with in_nmi() || in_hardirq() in __get_vm_area_node(). Update to a fixed kernel version. If immediate patching is not possible, avoid triggering bridge operations that disable BH, such as VLAN additions, until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63955. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart