CVE-2026-63955

mm/vmalloc: do not trigger BUG() on BH disabled context

High · published July 19, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
41.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

mm/vmalloc: do not trigger BUG() on BH disabled context

__get_vm_area_node() currently triggers a BUG() if in_interrupt() returns

true. However, in_interrupt() also reports true when BH are disabled.

The bridge code can call rhashtable_lookup_insert_fast() with bottom

halves disabled:

__vlan_add()

-> br_fdb_add_local()

spin_lock_bh(&br->hash_lock); <-- Disable BH

-> fdb_add_local()

-> fdb_create()

-> rhashtable_lookup_insert_fast()

-> kvmalloc()

-> vmalloc()

-> __get_vm_area_node()

-> BUG_ON(in_interrupt())

spin_unlock_bh(&br->hash_lock)

this triggers the BUG() despite the caller not being in NMI or

hard IRQ context.

Replace the in_interrupt() check with in_nmi() || in_hardirq().

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00488 · 41.0th percentile
Published
2026-07-19T14:55Z
EPSS history
Timeline
  • 19 JUL 14:55Z
    mm/vmalloc: do not trigger BUG() on BH disabled context
    cvelistv5