Linux Kernel Bridge Port Vulnerability Affecting Network Management

CVE-2026-63989

What is CVE-2026-63989?

A vulnerability exists in the Linux kernel related to the handling of bridge ports, specifically in the netlink configuration. This issue arises when the bridge lock is held while invoking br_setport(), a function which has evolved to process a wider range of attributes. While some attributes do not require the bridge lock, others, such as those related to the Spanning Tree Protocol (STP), do. This discrepancy can lead to the bridge calling functions that may sleep while in an atomic context, potentially causing system stability issues. The vulnerability has been mitigated by revising the locking mechanisms to reduce the scope of the bridge lock, ensuring that it is only held when processing attributes that require it.

References