CVE-2026-63988

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bridge: Fix sleep in atomic context in sysfs path<br /> <br /> Since the start of the git history, brport_store() always acquired the<br /> bridge lock. Back then this decision made sense: The bridge lock<br /> protects the STP state of the bridge and its ports and at that time the<br /> function was only used by two STP related attributes (cost and<br /> priority).<br /> <br /> Nowadays, brport_store() processes a lot more attributes and most of<br /> them do not need the bridge lock:<br /> <br /> * Bridge flags: Only require RTNL. Read locklessly by the data path.<br /> Annotations can be added in net-next.<br /> <br /> * FDB port flushing: Only requires the FDB lock.<br /> <br /> * Multicast attributes: Only require the multicast lock.<br /> <br /> * Group forward mask: Only requires RTNL. Read locklessly by the data<br /> path. Annotations can be added in net-next.<br /> <br /> * Backup port: Only requires RTNL. Read locklessly by the data path.<br /> <br /> This is a problem as the bridge calls dev_set_promiscuity() when certain<br /> bridge port flags change and this function can sleep since the commit<br /> cited below, resulting in a splat such as [1].<br /> <br /> Fix this by reducing the scope of the bridge lock and only take it when<br /> processing the two STP related attributes that require it. Remove the<br /> now stale comment from br_switchdev_set_port_flag(). The<br /> SWITCHDEV_F_DEFER flag can be removed in net-next.<br /> <br /> [1]<br /> BUG: sleeping function called from invalid context at net/core/dev_addr_lists.c:1262<br /> in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 372, name: bash<br /> preempt_count: 201, expected: 0<br /> RCU nest depth: 0, expected: 0<br /> 5 locks held by bash/372:<br /> #0: ffff88810c51c3f0 (sb_writers#7){.+.+}-{0:0}, at: ksys_write (fs/read_write.c:740)<br /> #1: ffff888115ce9480 (&amp;of-&gt;mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter (fs/kernfs/file.c:343)<br /> #2: ffff88810b9fd330 (kn-&gt;active#37){.+.+}-{0:0}, at: kernfs_fop_write_iter (fs/kernfs/file.c:80 fs/kernfs/file.c:344)<br /> #3: ffffffffa59473a0 (rtnl_mutex){+.+.}-{4:4}, at: brport_store (net/bridge/br_sysfs_if.c:326)<br /> #4: ffff8881099d2d58 (&amp;br-&gt;lock){+...}-{3:3}, at: brport_store (./include/linux/spinlock.h:348 net/bridge/br_sysfs_if.c:345)<br /> Preemption disabled at:<br /> 0x0<br /> Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011<br /> Call Trace:<br /> <br /> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)<br /> __might_resched.cold (kernel/sched/core.c:9163)<br /> netif_rx_mode_run (net/core/dev_addr_lists.c:1262)<br /> netif_rx_mode_sync (net/core/dev_addr_lists.c:1428)<br /> dev_set_promiscuity (net/core/dev_api.c:289)<br /> br_manage_promisc (net/bridge/br_if.c:135 net/bridge/br_if.c:172)<br /> br_port_flags_change (net/bridge/br_if.c:242 net/bridge/br_if.c:747)<br /> store_learning (net/bridge/br_sysfs_if.c:79 net/bridge/br_sysfs_if.c:235)<br /> brport_store (net/bridge/br_sysfs_if.c:346)<br /> kernfs_fop_write_iter (fs/kernfs/file.c:352)<br /> new_sync_write (fs/read_write.c:595)<br /> vfs_write (fs/read_write.c:688)<br /> ksys_write (fs/read_write.c:740)<br /> do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)<br /> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)