Description
In the Linux kernel, the following vulnerability has been resolved: bridge: mrp: reject zero test interval to avoid OOM panic br_mrp_start_test() and br_mrp_start_in_test() accept the user-supplied interval value from netlink without validation. When interval is 0, usecs_to_jiffies(0) yields 0, causing the delayed work (br_mrp_test_work_expired / br_mrp_in_test_work_expired) to reschedule itself with zero delay. This creates a tight loop on system_percpu_wq that allocates and transmits MRP test frames at maximum rate, exhausting all system memory and causing a kernel panic via OOM deadlock. The same zero-interval issue applies to br_mrp_start_in_test_parse() for interconnect test frames. Use NLA_POLICY_MIN(NLA_U32, 1) in the nla_policy tables for both IFLA_BRIDGE_MRP_START_TEST_INTERVAL and IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL, so zero is rejected at the netlink attribute parsing layer before the value ever reaches the workqueue scheduling code. This is consistent with how other bridge subsystems (br_fdb, br_mst) enforce range constraints on netlink attributes.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
20f6a05ef63594feb0c6dfbd629da0448b43124d to < 610073ffb77ffd2b5eca182d2ac264de4834a175affected20f6a05ef63594feb0c6dfbd629da0448b43124d to < ec8850be9b2b3beac1c7967d95f169dd2785979daffected20f6a05ef63594feb0c6dfbd629da0448b43124d to < 1ec86b4b9e28170a2565cf36f0e6e2b96b55134daffected20f6a05ef63594feb0c6dfbd629da0448b43124d to < 2120bd8546cd6a63c558d135773aa8f41c8259fcaffected20f6a05ef63594feb0c6dfbd629da0448b43124d to < 630a15a31c2034b5b697f4aabc769b9d80d82446affected20f6a05ef63594feb0c6dfbd629da0448b43124d to < e8ec80430bfa520e7352155d6ac632e527cba7aaaffected20f6a05ef63594feb0c6dfbd629da0448b43124d to < c9bc352f716d1bebfe43354bce539ec2d0223b30affected20f6a05ef63594feb0c6dfbd629da0448b43124d to < fa6e24963342de4370e3a3c9af41e38277b74cf3affected
Linux Linux
Default version status: affected
5.8affected0 to < 5.8unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.92 to ≤ 6.12.*unaffected6.18.34 to ≤ 6.18.*unaffected6.19.12 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/610073ffb77ffd2b5eca182d2ac264de4834a175 ↗
- https://git.kernel.org/stable/c/ec8850be9b2b3beac1c7967d95f169dd2785979d ↗
- https://git.kernel.org/stable/c/1ec86b4b9e28170a2565cf36f0e6e2b96b55134d ↗
- https://git.kernel.org/stable/c/2120bd8546cd6a63c558d135773aa8f41c8259fc ↗
- https://git.kernel.org/stable/c/630a15a31c2034b5b697f4aabc769b9d80d82446 ↗
- https://git.kernel.org/stable/c/e8ec80430bfa520e7352155d6ac632e527cba7aa ↗
- https://git.kernel.org/stable/c/c9bc352f716d1bebfe43354bce539ec2d0223b30 ↗
- https://git.kernel.org/stable/c/fa6e24963342de4370e3a3c9af41e38277b74cf3 ↗