EXPLOIT/ALERT Back to feed

Linux vulnerability

In the Linux kernel, the following vulnerability has been resolved: bridge: mrp: reject zero test interval to avoid OOM panic br_mrp_start_test() and br_mrp_start_in_test() accept the user-supplied interval value from netlink without validation. When interval is 0, usecs_to_jiffies(0) yields 0, causing the delayed work (br_mrp_test_work_expired / br_mrp_in_test_work_expired) to reschedule itself with zero delay. This creates a tight loop on system_percpu_wq that allocates and transmits MRP test frames at maximum rate, exhausting all system memory and causing a kernel panic via OOM deadlock. The same zero-interval issue applies to br_mrp_start_in_test_parse() for interconnect test frames. Use NLA_POLICY_MIN(NLA_U32, 1) in the nla_policy tables for both IFLA_BRIDGE_MRP_START_TEST_INTERVAL and IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL, so zero is rejected at the netlink attribute parsing layer before the value ever reaches the workqueue scheduling code. This is consistent with how other bridge subsystems (br_fdb, br_mst) enforce range constraints on netlink attributes.

Published 13 Apr 2026Updated 14 Sep 20268 sources
CVSS 5.5
Overview Sources History

What happened

In the Linux kernel, the following vulnerability has been resolved: bridge: mrp: reject zero test interval to avoid OOM panic br_mrp_start_test() and br_mrp_start_in_test() accept the user-supplied interval value from netlink without validation. When interval is 0, usecs_to_jiffies(0) yields 0, causing the delayed work (br_mrp_test_work_expired / br_mrp_in_test_work_expired) to reschedule itself with zero delay. This creates a tight loop on system_percpu_wq that allocates and transmits MRP test frames at maximum rate, exhausting all system memory and causing a kernel panic via OOM deadlock. The same zero-interval issue applies to br_mrp_start_in_test_parse() for interconnect test frames. Use NLA_POLICY_MIN(NLA_U32, 1) in the nla_policy tables for both IFLA_BRIDGE_MRP_START_TEST_INTERVAL and IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL, so zero is rejected at the netlink attribute parsing layer before the value ever reaches the workqueue scheduling code. This is consistent with how other bridge subsystems (br_fdb, br_mst) enforce range constraints on netlink attributes.

Affected versions

Linux: 20f6a05ef63594feb0c6dfbd629da0448b43124d through before 610073ffb77ffd2b5eca182d2ac264de4834a175 (git); 20f6a05ef63594feb0c6dfbd629da0448b43124d through before ec8850be9b2b3beac1c7967d95f169dd2785979d (git); 20f6a05ef63594feb0c6dfbd629da0448b43124d through before 1ec86b4b9e28170a2565cf36f0e6e2b96b55134d (git); 20f6a05ef63594feb0c6dfbd629da0448b43124d through before 2120bd8546cd6a63c558d135773aa8f41c8259fc (git); 20f6a05ef63594feb0c6dfbd629da0448b43124d through before 630a15a31c2034b5b697f4aabc769b9d80d82446 (git); 20f6a05ef63594feb0c6dfbd629da0448b43124d through before e8ec80430bfa520e7352155d6ac632e527cba7aa (git); 20f6a05ef63594feb0c6dfbd629da0448b43124d through before c9bc352f716d1bebfe43354bce539ec2d0223b30 (git); 20f6a05ef63594feb0c6dfbd629da0448b43124d through before fa6e24963342de4370e3a3c9af41e38277b74cf3 (git); 5.8 Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

  • Apply vendor-provided updates or mitigations.
  • Review affected product exposure and access logs.

Public PoC references

No public PoC reference has passed the current publication threshold.

CorrectionsReport an issue