The Linux kernel vulnerability (CVE-2026-63955) involves the function __get_vm_area_node() in the mm/vmalloc area, which incorrectly triggers a BUG() when called in a bottom halves disabled context. This is because the in_interrupt() function returns true not only for hard IRQ or NMI contexts but also when bottom halves are disabled, leading to unintended kernel BUG() calls. The vulnerability is triggered in bridge code paths involving rhashtable_lookup_insert_fast() with BH disabled. The patch replaces the in_interrupt() check with a more accurate condition checking specifically for in_nmi() or in_hardirq(), preventing erroneous BUG() triggers.

This vulnerability causes the Linux kernel to trigger a BUG() and potentially crash or halt when executing certain code paths with bottom halves disabled, even though the context is not a hard IRQ or NMI. This can lead to system instability or denial of service due to unexpected kernel panics.

A fix has been implemented that replaces the in_interrupt() check with a check for in_nmi() or in_hardirq() in the __get_vm_area_node() function. Users should apply the official Linux kernel updates that include this patch to prevent unintended kernel BUG() triggers. Patch status is not explicitly stated in the provided data; check the official Linux kernel advisories for the relevant fixed versions and apply updates accordingly.