In the Linux kernel, the following vulnerability has been resolved:
net: bridge: fix soft lockup in brmulticastquery_expired()
When set multicastqueryinterval to a large value, the local variable 'time' in brmulticastsendquery() may overflow. If the time is smaller than jiffies, the timer will expire immediately, and then call modtimer() again, which creates a loop and may trigger the following soft lockup issue.
watchdog: BUG: soft lockup - CPU#1 stuck for 221s! [rbconsumer:66] CPU: 1 UID: 0 PID: 66 Comm: rbconsumer Not tainted 6.16.0+ #259 PREEMPT(none) Call Trace: <IRQ> _netdevallocskb+0x2e/0x3a0 brip6multicastallocquery+0x212/0x1b70 _brmulticastsendquery+0x376/0xac0 brmulticastsendquery+0x299/0x510 brmulticastqueryexpired.constprop.0+0x16d/0x1b0 calltimerfn+0x3b/0x2a0 _runtimers+0x619/0x950 runtimersoftirq+0x11c/0x220 handlesoftirqs+0x18e/0x560 _irqexitrcu+0x158/0x1a0 sysvecapictimerinterrupt+0x76/0x90 </IRQ>
This issue can be reproduced with: ip link add br0 type bridge echo 1 > /sys/class/net/br0/bridge/multicastquerier echo 0xffffffffffffffff > /sys/class/net/br0/bridge/multicastquery_interval ip link set dev br0 up
The multicaststartupquery_interval can also cause this issue. Similar to the commit 99b40610956a ("net: bridge: mcast: add and enforce query interval minimum"), add check for the query interval maximum to fix this issue.
[
{
"signature_type": "Function",
"digest": {
"function_hash": "139635058658405156823735622842324933619",
"length": 423.0
},
"target": {
"file": "net/bridge/br_multicast.c",
"function": "br_multicast_set_query_intvl"
},
"signature_version": "v1",
"id": "CVE-2025-39773-21a5a30a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1547bf460baec718b3398365f8de33d25c5f36f"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "147086551027475170618013288509435928445",
"length": 471.0
},
"target": {
"file": "net/bridge/br_multicast.c",
"function": "br_multicast_set_startup_query_intvl"
},
"signature_version": "v1",
"id": "CVE-2025-39773-9befcfa4",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1547bf460baec718b3398365f8de33d25c5f36f"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"309336485502285687669398450426856912629",
"326448557560538176415785188850639145018",
"20686642986397172502032558851366335475",
"166708325798625245395649828570699204071",
"154438710778946585202628872596067477765",
"127359093951278320770585251343616112833"
]
},
"target": {
"file": "net/bridge/br_multicast.c"
},
"signature_version": "v1",
"id": "CVE-2025-39773-dedc7a58",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1547bf460baec718b3398365f8de33d25c5f36f"
}
]