In the Linux kernel, the following vulnerability has been resolved:
net: bridge: fix soft lockup in brmulticastquery_expired()
When set multicastqueryinterval to a large value, the local variable 'time' in brmulticastsendquery() may overflow. If the time is smaller than jiffies, the timer will expire immediately, and then call modtimer() again, which creates a loop and may trigger the following soft lockup issue.
watchdog: BUG: soft lockup - CPU#1 stuck for 221s! [rbconsumer:66] CPU: 1 UID: 0 PID: 66 Comm: rbconsumer Not tainted 6.16.0+ #259 PREEMPT(none) Call Trace: <IRQ> _netdevallocskb+0x2e/0x3a0 brip6multicastallocquery+0x212/0x1b70 _brmulticastsendquery+0x376/0xac0 brmulticastsendquery+0x299/0x510 brmulticastqueryexpired.constprop.0+0x16d/0x1b0 calltimerfn+0x3b/0x2a0 _runtimers+0x619/0x950 runtimersoftirq+0x11c/0x220 handlesoftirqs+0x18e/0x560 _irqexitrcu+0x158/0x1a0 sysvecapictimerinterrupt+0x76/0x90 </IRQ>
This issue can be reproduced with: ip link add br0 type bridge echo 1 > /sys/class/net/br0/bridge/multicastquerier echo 0xffffffffffffffff > /sys/class/net/br0/bridge/multicastquery_interval ip link set dev br0 up
The multicaststartupquery_interval can also cause this issue. Similar to the commit 99b40610956a ("net: bridge: mcast: add and enforce query interval minimum"), add check for the query interval maximum to fix this issue.
[
{
"id": "CVE-2025-39773-0f414e3b",
"deprecated": false,
"digest": {
"function_hash": "139635058658405156823735622842324933619",
"length": 423.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bdb19cd0de739870bb3494c815138b9dc30875c4",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_multicast.c",
"function": "br_multicast_set_query_intvl"
}
},
{
"id": "CVE-2025-39773-1ee029d5",
"deprecated": false,
"digest": {
"function_hash": "139635058658405156823735622842324933619",
"length": 423.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5bf5fce8a0c2a70d063af778fdb5b27238174cdd",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_multicast.c",
"function": "br_multicast_set_query_intvl"
}
},
{
"id": "CVE-2025-39773-21a5a30a",
"deprecated": false,
"digest": {
"function_hash": "139635058658405156823735622842324933619",
"length": 423.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1547bf460baec718b3398365f8de33d25c5f36f",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_multicast.c",
"function": "br_multicast_set_query_intvl"
}
},
{
"id": "CVE-2025-39773-2d3bdd8b",
"deprecated": false,
"digest": {
"function_hash": "147086551027475170618013288509435928445",
"length": 471.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5bf5fce8a0c2a70d063af778fdb5b27238174cdd",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_multicast.c",
"function": "br_multicast_set_startup_query_intvl"
}
},
{
"id": "CVE-2025-39773-30811d71",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"309336485502285687669398450426856912629",
"326448557560538176415785188850639145018",
"20686642986397172502032558851366335475",
"166708325798625245395649828570699204071",
"154438710778946585202628872596067477765",
"127359093951278320770585251343616112833"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bdb19cd0de739870bb3494c815138b9dc30875c4",
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "net/bridge/br_multicast.c"
}
},
{
"id": "CVE-2025-39773-4507f56d",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"309336485502285687669398450426856912629",
"326448557560538176415785188850639145018",
"20686642986397172502032558851366335475",
"166708325798625245395649828570699204071",
"154438710778946585202628872596067477765",
"127359093951278320770585251343616112833"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96476b043efb86a94f2badd260f7f99c97bd5893",
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "net/bridge/br_multicast.c"
}
},
{
"id": "CVE-2025-39773-496d6304",
"deprecated": false,
"digest": {
"function_hash": "147086551027475170618013288509435928445",
"length": 471.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bdb19cd0de739870bb3494c815138b9dc30875c4",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_multicast.c",
"function": "br_multicast_set_startup_query_intvl"
}
},
{
"id": "CVE-2025-39773-63be205c",
"deprecated": false,
"digest": {
"function_hash": "147086551027475170618013288509435928445",
"length": 471.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43e281fde5e76a866a4d10780c35023f16c0e432",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_multicast.c",
"function": "br_multicast_set_startup_query_intvl"
}
},
{
"id": "CVE-2025-39773-73c7b58d",
"deprecated": false,
"digest": {
"function_hash": "147086551027475170618013288509435928445",
"length": 471.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96476b043efb86a94f2badd260f7f99c97bd5893",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_multicast.c",
"function": "br_multicast_set_startup_query_intvl"
}
},
{
"id": "CVE-2025-39773-7a52c9eb",
"deprecated": false,
"digest": {
"function_hash": "139635058658405156823735622842324933619",
"length": 423.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43e281fde5e76a866a4d10780c35023f16c0e432",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_multicast.c",
"function": "br_multicast_set_query_intvl"
}
},
{
"id": "CVE-2025-39773-85a2d53c",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"309336485502285687669398450426856912629",
"326448557560538176415785188850639145018",
"20686642986397172502032558851366335475",
"166708325798625245395649828570699204071",
"154438710778946585202628872596067477765",
"127359093951278320770585251343616112833"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5bf5fce8a0c2a70d063af778fdb5b27238174cdd",
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "net/bridge/br_multicast.c"
}
},
{
"id": "CVE-2025-39773-9befcfa4",
"deprecated": false,
"digest": {
"function_hash": "147086551027475170618013288509435928445",
"length": 471.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1547bf460baec718b3398365f8de33d25c5f36f",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_multicast.c",
"function": "br_multicast_set_startup_query_intvl"
}
},
{
"id": "CVE-2025-39773-a270e2f9",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"309336485502285687669398450426856912629",
"326448557560538176415785188850639145018",
"20686642986397172502032558851366335475",
"166708325798625245395649828570699204071",
"154438710778946585202628872596067477765",
"127359093951278320770585251343616112833"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43e281fde5e76a866a4d10780c35023f16c0e432",
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "net/bridge/br_multicast.c"
}
},
{
"id": "CVE-2025-39773-dedc7a58",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"309336485502285687669398450426856912629",
"326448557560538176415785188850639145018",
"20686642986397172502032558851366335475",
"166708325798625245395649828570699204071",
"154438710778946585202628872596067477765",
"127359093951278320770585251343616112833"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1547bf460baec718b3398365f8de33d25c5f36f",
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "net/bridge/br_multicast.c"
}
},
{
"id": "CVE-2025-39773-e458692c",
"deprecated": false,
"digest": {
"function_hash": "139635058658405156823735622842324933619",
"length": 423.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96476b043efb86a94f2badd260f7f99c97bd5893",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_multicast.c",
"function": "br_multicast_set_query_intvl"
}
}
]