What is the CVSS score of CVE-2026-63955?

CVE-2026-63955 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-63955?

A denial-of-service vulnerability in Linux kernel systems with network bridging configurations can cause unexpected server crashes through a fault in memory allocation handling.. A patch is available.

How to fix or mitigate CVE-2026-63955?

Within 24 hours, inventory Linux systems in production to identify those using network bridging features and note their current kernel versions for comparison against vendor advisories. Within 7 days, apply the available patch from your Linux distribution (obtain the specific version from vendor security bulletins) to systems with network bridging configurations, prioritizing production infrastructure; coordinate with operations for maintenance windows. Within 30 days, ensure patch compliance across all affected Linux systems and validate through kernel version verification.

Linux Kernel CVE-2026-63955

EUVD-2026-45728 HIGH

2026-07-19 Linux

GHSA-jvrv-jph4-c9c9

Information Disclosure Linux

High

Disputed · 7.5 Vendor: Linux

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Trigger is a local bridge-config path needing CAP_NET_ADMIN (obtainable via user namespaces), so AV:L/PR:L; impact is a kernel panic, hence A:H only with C:N/I:N.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:33 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.5 (HIGH)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:55 cve.org

HIGH 7.5

CVE Published

Jul 19, 2026 - 14:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mm/vmalloc: do not trigger BUG() on BH disabled context

__get_vm_area_node() currently triggers a BUG() if in_interrupt() returns true. However, in_interrupt() also reports true when BH are disabled.

The bridge code can call rhashtable_lookup_insert_fast() with bottom halves disabled:

__vlan_add() -> br_fdb_add_local() spin_lock_bh(&br->hash_lock); <-- Disable BH -> fdb_add_local() -> fdb_create() -> rhashtable_lookup_insert_fast() -> kvmalloc() -> vmalloc() -> __get_vm_area_node() -> BUG_ON(in_interrupt()) spin_unlock_bh(&br->hash_lock)

this triggers the BUG() despite the caller not being in NMI or hard IRQ context.

Replace the in_interrupt() check with in_nmi() || in_hardirq().

AnalysisAI

Kernel panic (denial of service) in the Linux kernel's mm/vmalloc subsystem occurs because __get_vm_area_node() calls BUG_ON(in_interrupt()), and in_interrupt() also returns true when bottom halves (softirqs) are merely disabled rather than in a genuine interrupt context. A legitimate network-bridge path (br_fdb_add_local under spin_lock_bh) reaches vmalloc while BH is disabled, tripping the BUG() and crashing the kernel. NVD scores this A:H (availability only) with no public exploit identified at time of analysis; EPSS is low at 0.19% (9th percentile) and it is not in CISA KEV.

Technical ContextAI

The root cause is an over-broad context check in the kernel virtual-memory allocator. __get_vm_area_node() guards against being called from atomic interrupt context but used in_interrupt(), a macro that conflates hard IRQ, softirq, and BH-disabled contexts. When the bridge subsystem adds a local FDB entry (__vlan_add -> br_fdb_add_local -> fdb_create -> rhashtable_lookup_insert_fast -> kvmalloc -> vmalloc), it holds br->hash_lock via spin_lock_bh(), which disables bottom halves. That makes in_interrupt() report true even though the code runs in normal process context, so kvmalloc()'s fall-through to vmalloc() hits BUG_ON() and panics. The fix narrows the assertion to in_nmi() || in_hardirq(), the genuinely unsafe contexts. Affected products per CPE are limited to the Linux kernel (cpe:2.3:a:linux:linux:*). No CWE is assigned, but this is effectively a reachable assertion / improper context handling leading to a crash (akin to CWE-617 Reachable Assertion / CWE-248).

RemediationAI

Upstream fix available (commits ad7eff07b625f53c3fb513b30d7a8c5a79fbc7ce and 04aa71da5f35aacdc9ae9cb5150947daa624f641); apply the vendor-released patched stable kernel - EUVD data indicates fixed releases in the 7.0.12 and 7.1 lines plus the 6.19 fix. Rebuild or update to a distribution kernel that includes these commits and verify your distro's changelog references the commit hashes, since release numbering varies by vendor. As a temporary compensating control where patching is not immediate, restrict who can create and configure Linux bridges with VLAN filtering and add local FDB entries by limiting CAP_NET_ADMIN and disabling unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0 / user.max_user_namespaces=0), accepting the trade-off that this breaks rootless-container networking. These are mitigations, not fixes; upgrading the kernel is the correct remediation. Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-63955.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-63955 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63955

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code