Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2025-39773

net: bridge: fix soft lockup in br_multicast_query_expired()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix soft lockup in br_multicast_query_expired() When set multicast_query_interval to a large value, the local variable 'time' in br_multicast_send_query() may overflow. If the time is smaller than jiffies, the timer will expire immediately, and then call mod_timer() again, which creates a loop and may trigger the following soft lockup issue. watchdog: BUG: soft lockup - CPU#1 stuck for 221s! [rb_consumer:66] CPU: 1 UID: 0 PID: 66 Comm: rb_consumer Not tainted 6.16.0+ #259 PREEMPT(none) Call Trace: <IRQ> __netdev_alloc_skb+0x2e/0x3a0 br_ip6_multicast_alloc_query+0x212/0x1b70 __br_multicast_send_query+0x376/0xac0 br_multicast_send_query+0x299/0x510 br_multicast_query_expired.constprop.0+0x16d/0x1b0 call_timer_fn+0x3b/0x2a0 __run_timers+0x619/0x950 run_timer_softirq+0x11c/0x220 handle_softirqs+0x18e/0x560 __irq_exit_rcu+0x158/0x1a0 sysvec_apic_timer_interrupt+0x76/0x90 </IRQ> This issue can be reproduced with: ip link add br0 type bridge echo 1 > /sys/class/net/br0/bridge/multicast_querier echo 0xffffffffffffffff > /sys/class/net/br0/bridge/multicast_query_interval ip link set dev br0 up The multicast_startup_query_interval can also cause this issue. Similar to the commit 99b40610956a ("net: bridge: mcast: add and enforce query interval minimum"), add check for the query interval maximum to fix this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • d902eee43f1951b358d7347d9165c6af21cf7b1b to < 34171b9e53bd1dc264f5556579f2b04f04435c73affected
  • d902eee43f1951b358d7347d9165c6af21cf7b1b to < 43e281fde5e76a866a4d10780c35023f16c0e432affected
  • d902eee43f1951b358d7347d9165c6af21cf7b1b to < 96476b043efb86a94f2badd260f7f99c97bd5893affected
  • d902eee43f1951b358d7347d9165c6af21cf7b1b to < bdb19cd0de739870bb3494c815138b9dc30875c4affected
  • d902eee43f1951b358d7347d9165c6af21cf7b1b to < 5bf5fce8a0c2a70d063af778fdb5b27238174cddaffected
  • d902eee43f1951b358d7347d9165c6af21cf7b1b to < d1547bf460baec718b3398365f8de33d25c5f36faffected

Linux Linux

Default version status: affected

  • 2.6.34affected
  • 0 to < 2.6.34unaffected
  • 5.15.190 to ≤ 5.15.*unaffected
  • 6.1.149 to ≤ 6.1.*unaffected
  • 6.6.103 to ≤ 6.6.*unaffected
  • 6.12.44 to ≤ 6.12.*unaffected
  • 6.16.4 to ≤ 6.16.*unaffected
  • 6.17 to ≤ *unaffected

References