{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-64537",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2026-64537"
  ],
  "published": "2026-07-27T20:10:44Z",
  "summary": "bridge: cfm: reject invalid CCM interval at configuration time",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: cfm: reject invalid CCM interval at configuration time\n\nccm_tx_work_expired() re-arms itself via queue_delayed_work() using\nthe configured exp_interval converted by interval_to_us(). When\nexp_interval is BR_CFM_CCM_INTERVAL_NONE or out of range,\ninterval_to_us() returns 0, causing the worker to fire immediately in\na tight loop that allocates skbs until OOM.\n\nFix this by validating exp_interval at configuration time:\n\n - Constrain IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL to the valid range\n   [BR_CFM_CCM_INTERVAL_3_3_MS, BR_CFM_CCM_INTERVAL_10_MIN] in the\n   netlink policy so userspace cannot set an invalid value.\n\n - Reject starting CCM TX in br_cfm_cc_ccm_tx() when exp_interval has\n   not yet been configured (defaults to 0 from kzalloc).",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.178",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64537"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2870056a78961e0fecd652362ee9d3fcfd24a8a6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f0f5eb59a97ece0d85de8cfa95dc18c609302a8b"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/53788b134519e995699ea3721969c96a08d64575"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b42aeb58317f12024734759ff745856b53948873"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a090880c1f544589427e5b7050c40fb211ccecb4"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/865643640b5b5c4579b32d7a55ac9ad648362eaa"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f3e02edd8322b31b8e6517faa6ba053bf29d1e26"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-17T05:24:08Z"
  }
}