CVE-2026-31420
- Source
- https://cve.org/CVERecord?id=CVE-2026-31420
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31420.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-31420
- Downstream
- Related
- Published
- 2026-04-13T13:40:24Z
- Modified
- 2026-08-12T03:30:37Z
- Summary
- bridge: mrp: reject zero test interval to avoid OOM panic
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
bridge: mrp: reject zero test interval to avoid OOM panic
br_mrp_start_test() and br_mrp_start_in_test() accept the user-supplied interval value from netlink without validation. When interval is 0, usecs_to_jiffies(0) yields 0, causing the delayed work (br_mrp_test_work_expired / br_mrp_in_test_work_expired) to reschedule itself with zero delay. This creates a tight loop on system_percpu_wq that allocates and transmits MRP test frames at maximum rate, exhausting all system memory and causing a kernel panic via OOM deadlock.
The same zero-interval issue applies to br_mrp_start_in_test_parse() for interconnect test frames.
Use NLA_POLICY_MIN(NLA_U32, 1) in the nla_policy tables for both IFLA_BRIDGE_MRP_START_TEST_INTERVAL and IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL, so zero is rejected at the netlink attribute parsing layer before the value ever reaches the workqueue scheduling code. This is consistent with how other bridge subsystems (br_fdb, br_mst) enforce range constraints on netlink attributes.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31420.json" }- References
-
- https://git.kernel.org/stable/c/630a15a31c2034b5b697f4aabc769b9d80d82446
- https://git.kernel.org/stable/c/c9bc352f716d1bebfe43354bce539ec2d0223b30
- https://git.kernel.org/stable/c/e8ec80430bfa520e7352155d6ac632e527cba7aa
- https://git.kernel.org/stable/c/fa6e24963342de4370e3a3c9af41e38277b74cf3
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31420.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-31420
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced20f6a05ef63594feb0c6dfbd629da0448b43124dFixed630a15a31c2034b5b697f4aabc769b9d80d82446Fixede8ec80430bfa520e7352155d6ac632e527cba7aaFixedc9bc352f716d1bebfe43354bce539ec2d0223b30Fixedfa6e24963342de4370e3a3c9af41e38277b74cf3