CVE-2026-63955 mm/vmalloc: do not trigger BUG() on BH disabled context
A local attacker can trigger a kernel panic by performing network bridge operations that disable bottom halves, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63955?
CVE-2026-63955 is a high-severity denial of service vulnerability in Linux, published on 19 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm/vmalloc: do not trigger BUG() on BH disabled context
__get_vm_area_node() currently triggers a BUG() if in_interrupt() returns true. However, in_interrupt() also reports true when BH are disabled.
The bridge code can call rhashtable_lookup_insert_fast() with bottom halves disabled:
__vlan_add() -> br_fdb_add_local() spin_lock_bh(&br->hash_lock); <-- Disable BH -> fdb_add_local() -> fdb_create() -> rhashtable_lookup_insert_fast() -> kvmalloc() -> vmalloc() -> __get_vm_area_node() -> BUG_ON(in_interrupt()) spin_unlock_bh(&br->hash_lock)
this triggers the BUG() despite the caller not being in NMI or hard IRQ context.
Replace the in_interrupt() check with in_nmi() || in_hardirq().
Which versions are affected by CVE-2026-63955?
How do I fix CVE-2026-63955?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-63955 being exploited?
There is no known exploitation of CVE-2026-63955 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-63955, GHSA-jvrv-jph4-c9c9, UBUNTU-CVE-2026-63955.