In the Linux kernel, the following vulnerability has been resolved: bridge: Fix sleep in atomic context in netlink path Since the introduction of… (CVE-2026-63989)
A vulnerability in the Linux kernel bridge netlink path was fixed to address an issue where a sleeping function was called from an atomic context. The problem arose because the bridge lock was held too broadly around the br_setport() function, which processes various bridge port attributes. Some of these attributes cause calls to dev_set_promiscuity(), a function that can sleep, leading to kernel bugs. The fix reduces the scope of the bridge lock to only cover STP-related attributes that require it, preventing sleep calls in atomic context.
AI Analysis
Technical Summary
The Linux kernel bridge netlink path vulnerability (CVE-2026-63989) involves improper locking around the br_setport() function. Initially, the bridge lock was held during all attribute processing, but as br_setport() expanded to handle more attributes, some operations (like changing bridge port flags) triggered dev_set_promiscuity(), which can sleep. Holding the bridge lock during these calls caused sleeping in atomic context, leading to kernel BUGs. The fix narrows the bridge lock scope to only STP-related attributes, aligning with proper locking practices and preventing sleep calls under atomic context.
Potential Impact
This vulnerability can cause kernel crashes (BUGs) due to sleeping in atomic context, which may lead to system instability or denial of service. There is no indication of code execution or privilege escalation. No known exploits are reported in the wild.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to reduce the scope of the bridge lock in br_setport(), preventing sleeping in atomic context. Users should update to a kernel version that includes this fix once available. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories or vendor updates for the patched versions and apply them accordingly.
In the Linux kernel, the following vulnerability has been resolved: bridge: Fix sleep in atomic context in netlink path Since the introduction of… (CVE-2026-63989)
Description
A vulnerability in the Linux kernel bridge netlink path was fixed to address an issue where a sleeping function was called from an atomic context. The problem arose because the bridge lock was held too broadly around the br_setport() function, which processes various bridge port attributes. Some of these attributes cause calls to dev_set_promiscuity(), a function that can sleep, leading to kernel bugs. The fix reduces the scope of the bridge lock to only cover STP-related attributes that require it, preventing sleep calls in atomic context.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel bridge netlink path vulnerability (CVE-2026-63989) involves improper locking around the br_setport() function. Initially, the bridge lock was held during all attribute processing, but as br_setport() expanded to handle more attributes, some operations (like changing bridge port flags) triggered dev_set_promiscuity(), which can sleep. Holding the bridge lock during these calls caused sleeping in atomic context, leading to kernel BUGs. The fix narrows the bridge lock scope to only STP-related attributes, aligning with proper locking practices and preventing sleep calls under atomic context.
Potential Impact
This vulnerability can cause kernel crashes (BUGs) due to sleeping in atomic context, which may lead to system instability or denial of service. There is no indication of code execution or privilege escalation. No known exploits are reported in the wild.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to reduce the scope of the bridge lock in br_setport(), preventing sleeping in atomic context. Users should update to a kernel version that includes this fix once available. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories or vendor updates for the patched versions and apply them accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5x9q-485p-2v5m
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-63989"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27aa2a4a8d598912e247
Added to database: 07/19/2026, 19:38:18 UTC
Last enriched: 07/19/2026, 20:02:58 UTC
Last updated: 07/20/2026, 17:43:23 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.