CVE-2026-63989

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bridge: Fix sleep in atomic context in netlink path<br /> <br /> Since the introduction of the netlink configuration path for bridge<br /> ports in commit 25c71c75ac87 ("bridge: bridge port parameters over<br /> netlink"), br_setport() was always called with the bridge lock held<br /> around it. Back then this decision made sense: The bridge lock protects<br /> the STP state of the bridge and its ports and at that time the function<br /> only processed three STP related netlink attributes (cost, priority and<br /> state).<br /> <br /> Nowadays, br_setport() processes a lot more attributes and most of them<br /> do not need the bridge lock:<br /> <br /> * Bridge flags: Only require RTNL. Read locklessly by the data path.<br /> Annotations can be added in net-next.<br /> <br /> * FDB port flushing: Only requires the FDB lock.<br /> <br /> * Multicast attributes: Only require the multicast lock.<br /> <br /> * Group forward mask: Only requires RTNL. Read locklessly by the data<br /> path. Annotations can be added in net-next.<br /> <br /> * Backup port and NHID: Only require RTNL. Read locklessly by the data<br /> path.<br /> <br /> This is a problem as the bridge calls dev_set_promiscuity() when certain<br /> bridge port flags change and this function can sleep since the commit<br /> cited below, resulting in a splat such as [1].<br /> <br /> Fix this by reducing the scope of the bridge lock and only take it when<br /> processing the three STP related attributes that require it. This is<br /> consistent with the multicast attributes where each attribute acquires<br /> the multicast lock instead of having one critical section for all<br /> relevant attributes.<br /> <br /> [1]<br /> BUG: sleeping function called from invalid context at net/core/dev_addr_lists.c:1262<br /> in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 356, name: bridge<br /> preempt_count: 201, expected: 0<br /> RCU nest depth: 0, expected: 0<br /> 2 locks held by bridge/356:<br /> #0: ffffffff919473a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg (net/core/rtnetlink.c:80 net/core/rtnetlink.c:7002)<br /> #1: ffff888115072d58 (&amp;br-&gt;lock){+...}-{3:3}, at: br_setlink (./include/linux/spinlock.h:348 net/bridge/br_netlink.c:1117)<br /> Preemption disabled at:<br /> 0x0<br /> Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011<br /> Call Trace:<br /> <br /> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)<br /> __might_resched.cold (kernel/sched/core.c:9163)<br /> netif_rx_mode_run (net/core/dev_addr_lists.c:1262)<br /> netif_rx_mode_sync (net/core/dev_addr_lists.c:1428)<br /> dev_set_promiscuity (net/core/dev_api.c:289)<br /> br_manage_promisc (net/bridge/br_if.c:135 net/bridge/br_if.c:172)<br /> br_port_flags_change (net/bridge/br_if.c:242 net/bridge/br_if.c:747)<br /> br_setport (net/bridge/br_netlink.c:1000)<br /> br_setlink (net/bridge/br_netlink.c:1118)<br /> rtnl_bridge_setlink (net/core/rtnetlink.c:5572)<br /> rtnetlink_rcv_msg (net/core/rtnetlink.c:7005)<br /> netlink_rcv_skb (net/netlink/af_netlink.c:2550)<br /> netlink_unicast (net/netlink/af_netlink.c:1318 net/netlink/af_netlink.c:1344)<br /> netlink_sendmsg (net/netlink/af_netlink.c:1894)<br /> __sock_sendmsg (net/socket.c:787 (discriminator 4) net/socket.c:802 (discriminator 4))<br /> ____sys_sendmsg (net/socket.c:2698)<br /> ___sys_sendmsg (net/socket.c:2752)<br /> __sys_sendmsg (net/socket.c:2784)<br /> do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)<br /> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)