CVE-2026-63955

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/vmalloc: do not trigger BUG() on BH disabled context<br /> <br /> __get_vm_area_node() currently triggers a BUG() if in_interrupt() returns<br /> true. However, in_interrupt() also reports true when BH are disabled.<br /> <br /> The bridge code can call rhashtable_lookup_insert_fast() with bottom<br /> halves disabled:<br /> <br /> __vlan_add()<br /> -&gt; br_fdb_add_local()<br /> spin_lock_bh(&amp;br-&gt;hash_lock); fdb_add_local()<br /> -&gt; fdb_create()<br /> -&gt; rhashtable_lookup_insert_fast()<br /> -&gt; kvmalloc()<br /> -&gt; vmalloc()<br /> -&gt; __get_vm_area_node()<br /> -&gt; BUG_ON(in_interrupt())<br /> spin_unlock_bh(&amp;br-&gt;hash_lock)<br /> <br /> this triggers the BUG() despite the caller not being in NMI or<br /> hard IRQ context.<br /> <br /> Replace the in_interrupt() check with in_nmi() || in_hardirq().