CVE-2026-63955: mm/vmalloc: do not trigger BUG() on BH disabled context

Q: What circumstances can trigger the kernel BUG?

The issue can be triggered when bridge code adds a VLAN and reaches rhashtable_lookup_insert_fast() while bottom halves are disabled under br->hash_lock. The vmalloc path then treats the BH-disabled state as interrupt context and invokes BUG().

Published Jul 19, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

mm/vmalloc: do not trigger BUG() on BH disabled context

getvmareanode() currently triggers a BUG() if ininterrupt() returns true. However, ininterrupt() also reports true when BH are disabled.

The bridge code can call rhashtablelookupinsertfast() with bottom halves disabled:

vlanadd() -> brfdbaddlocal() spinlockbh(&br->hashlock); <-- Disable BH -> fdbaddlocal() -> fdbcreate() -> rhashtablelookupinsertfast() -> kvmalloc() -> vmalloc() -> getvmareanode() -> BUGON(ininterrupt()) spinunlockbh(&br->hashlock)

this triggers the BUG() despite the caller not being in NMI or hard IRQ context.

Replace the ininterrupt() check with innmi() || inhardirq().

Affected Software

10 affected componentsFixes available

Linux Linux kernel

Linux Linux kernel>=6.19<7.0.12

Linux Linux kernel=7.1-rc1

Linux Linux kernel=7.1-rc2

Linux Linux kernel=7.1-rc3

Linux Linux kernel=7.1-rc4

Linux Linux kernel=7.1-rc5

debian/linux<7.0.12-1

7.0.12-1

linux/kernel>=6.19.0<7.0.12

7.0.12

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Patch Available

https://git.kernel.org/stable/c/04aa71da5f35aacdc9ae9cb5150947daa624f641

Patch Available

https://git.kernel.org/stable/c/ad7eff07b625f53c3fb513b30d7a8c5a79fbc7ce

Event History

Jul 19, 2026

CVE Published

via MITRE·02:55 PM

Data Sourced

via MITRE·02:55 PM

DescriptionSeverity

Data Sourced

via OSV·02:55 PM

DescriptionSeverityAffected Software

Data Sourced

via NVD·04:17 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What circumstances can trigger the kernel BUG?

The issue can be triggered when bridge code adds a VLAN and reaches rhashtable_lookup_insert_fast() while bottom halves are disabled under br->hash_lock. The vmalloc path then treats the BH-disabled state as interrupt context and invokes BUG().

Is an NMI or hard IRQ context required to trigger this issue?

No. The described failure occurs even though the caller is not in NMI or hard IRQ context; bottom halves being disabled causes in_interrupt() to report true.

What is the impact of successful triggering?

The affected path triggers a kernel BUG(), resulting in a denial of service through system or kernel crash behavior. The supplied severity vector indicates availability impact only, with no stated confidentiality or integrity impact.

What is the available remediation?

A patch is available. The fix changes the vmalloc context check from in_interrupt() to checks for NMI or hard-IRQ context only.

CVE-2026-63955: mm/vmalloc: do not trigger BUG() on BH disabled context

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What circumstances can trigger the kernel BUG?

Is an NMI or hard IRQ context required to trigger this issue?

What is the impact of successful triggering?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

What circumstances can trigger the kernel BUG?

Is an NMI or hard IRQ context required to trigger this issue?

What is the impact of successful triggering?

What is the available remediation?