CVE-2026-64537

In the Linux kernel, the following vulnerability has been resolved:

bridge: cfm: reject invalid CCM interval at configuration time

ccmtxworkexpired() re-arms itself via queuedelayedwork() using the configured expinterval converted by intervaltous(). When expinterval is BRCFMCCMINTERVALNONE or out of range, intervalto_us() returns 0, causing the worker to fire immediately in a tight loop that allocates skbs until OOM.

Fix this by validating exp_interval at configuration time:

• Constrain IFLABRIDGECFMCCCONFIGEXPINTERVAL to the valid range [BRCFMCCMINTERVAL33MS, BRCFMCCMINTERVAL10_MIN] in the netlink policy so userspace cannot set an invalid value.

• Reject starting CCM TX in brcfmccccmtx() when exp_interval has not yet been configured (defaults to 0 from kzalloc).