CVE-2025-39773
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix soft lockup in br_multicast_query_expired() When set multicast_query_interval to a large value, the local variable 'time' in br_multicast_send_query() may overflow. If the time is smaller than jiffies, the timer will expire immediately, and then call mod_timer() again, which creates a loop and may trigger the following soft lockup issue. watchdog: BUG: soft lockup - CPU#1 stuck for 221s! [rb_consumer:66] CPU: 1 UID: 0 PID: 66 Comm: rb_consumer Not tainted 6.16.0+ #259 PREEMPT(none) Call Trace: <IRQ> __netdev_alloc_skb+0x2e/0x3a0 br_ip6_multicast_alloc_query+0x212/0x1b70 __br_multicast_send_query+0x376/0xac0 br_multicast_send_query+0x299/0x510 br_multicast_query_expired.constprop.0+0x16d/0x1b0 call_timer_fn+0x3b/0x2a0 __run_timers+0x619/0x950 run_timer_softirq+0x11c/0x220 handle_softirqs+0x18e/0x560 __irq_exit_rcu+0x158/0x1a0 sysvec_apic_timer_interrupt+0x76/0x90 </IRQ> This issue can be reproduced with: ip link add br0 type bridge echo 1 > /sys/class/net/br0/bridge/multicast_querier echo 0xffffffffffffffff > /sys/class/net/br0/bridge/multicast_query_interval ip link set dev br0 up The multicast_startup_query_interval can also cause this issue. Similar to the commit 99b40610956a ("net: bridge: mcast: add and enforce query interval minimum"), add check for the query interval maximum to fix this issue.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-09-11 17:15:43.010000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON
{
"id": "CVE-2025-39773",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-11T17:15:43.010",
"lastModified": "2026-10-19T21:10:00.160",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix soft lockup in br_multicast_query_expired()\n\nWhen set multicast_query_interval to a large value, the local variable\n'time' in br_multicast_send_query() may overflow. If the time is smaller\nthan jiffies, the timer will expire immediately, and then call mod_timer()\nagain, which creates a loop and may trigger the following soft lockup\nissue.\n\n watchdog: BUG: soft lockup - CPU#1 stuck for 221s! [rb_consumer:66]\n CPU: 1 UID: 0 PID: 66 Comm: rb_consumer Not tainted 6.16.0+ #259 PREEMPT(none)\n Call Trace:\n <IRQ>\n __netdev_alloc_skb+0x2e/0x3a0\n br_ip6_multicast_alloc_query+0x212/0x1b70\n __br_multicast_send_query+0x376/0xac0\n br_multicast_send_query+0x299/0x510\n br_multicast_query_expired.constprop.0+0x16d/0x1b0\n call_timer_fn+0x3b/0x2a0\n __run_timers+0x619/0x950\n run_timer_softirq+0x11c/0x220\n handle_softirqs+0x18e/0x560\n __irq_exit_rcu+0x158/0x1a0\n sysvec_apic_timer_interrupt+0x76/0x90\n </IRQ>\n\nThis issue can be reproduced with:\n ip link add br0 type bridge\n echo 1 > /sys/class/net/br0/bridge/multicast_querier\n echo 0xffffffffffffffff >\n \t/sys/class/net/br0/bridge/multicast_query_interval\n ip link set dev br0 up\n\nThe multicast_startup_query_interval can also cause this issue. Similar to\nthe commit 99b40610956a (\"net: bridge: mcast: add and enforce query\ninterval minimum\"), add check for the query interval maximum to fix this\nissue."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: bridge: corregir soft lockup en br_multicast_query_expired()\n\nCuando se establece multicast_query_interval a un valor grande, la variable local 'time' en br_multicast_send_query() puede desbordarse. Si el tiempo es menor que jiffies, el temporizador expirará inmediatamente, y luego llamará a mod_timer() de nuevo, lo que crea un bucle y puede desencadenar el siguiente problema de soft lockup.\n\n watchdog: BUG: soft lockup - CPU#1 atascada durante 221s! [rb_consumer:66]\n CPU: 1 UID: 0 PID: 66 Comm: rb_consumer No contaminado 6.16.0+ #259 PREEMPT(none)\n Traza de Llamada:\n <IRQ>\n __netdev_alloc_skb+0x2e/0x3a0\n br_ip6_multicast_alloc_query+0x212/0x1b70\n __br_multicast_send_query+0x376/0xac0\n br_multicast_send_query+0x299/0x510\n br_multicast_query_expired.constprop.0+0x16d/0x1b0\n call_timer_fn+0x3b/0x2a0\n __run_timers+0x619/0x950\n run_timer_softirq+0x11c/0x220\n handle_softirqs+0x18e/0x560\n __irq_exit_rcu+0x158/0x1a0\n sysvec_apic_timer_interrupt+0x76/0x90\n </IRQ>\n\nEste problema puede reproducirse con:\n ip link add br0 type bridge\n echo 1 > /sys/class/net/br0/bridge/multicast_querier\n echo 0xffffffffffffffff >\n \t/sys/class/net/br0/bridge/multicast_query_interval\n ip link set dev br0 up\n\nEl multicast_startup_query_interval también puede causar este problema. Similar al commit 99b40610956a ('net: bridge: mcast: añadir y aplicar el mínimo del intervalo de consulta'), añadir una comprobación para el máximo del intervalo de consulta para solucionar este problema."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"net/bridge/br_multicast.c",
"net/bridge/br_private.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "d902eee43f1951b358d7347d9165c6af21cf7b1b",
"lessThan": "34171b9e53bd1dc264f5556579f2b04f04435c73",
"versionType": "git",
"status": "affected"
},
{
"version": "d902eee43f1951b358d7347d9165c6af21cf7b1b",
"lessThan": "43e281fde5e76a866a4d10780c35023f16c0e432",
"versionType": "git",
"status": "affected"
},
{
"version": "d902eee43f1951b358d7347d9165c6af21cf7b1b",
"lessThan": "96476b043efb86a94f2badd260f7f99c97bd5893",
"versionType": "git",
"status": "affected"
},
{
"version": "d902eee43f1951b358d7347d9165c6af21cf7b1b",
"lessThan": "bdb19cd0de739870bb3494c815138b9dc30875c4",
"versionType": "git",
"status": "affected"
},
{
"version": "d902eee43f1951b358d7347d9165c6af21cf7b1b",
"lessThan": "5bf5fce8a0c2a70d063af778fdb5b27238174cdd",
"versionType": "git",
"status": "affected"
},
{
"version": "d902eee43f1951b358d7347d9165c6af21cf7b1b",
"lessThan": "d1547bf460baec718b3398365f8de33d25c5f36f",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"net/bridge/br_multicast.c",
"net/bridge/br_private.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "2.6.34",
"status": "affected"
},
{
"version": "0",
"lessThan": "2.6.34",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.190",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.149",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.103",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.44",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.16.4",
"lessThanOrEqual": "6.16.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
},
{
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"affectedData": [
{
"vendor": "Siemens",
"product": "SIMATIC CN 4100",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V5.0",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.6",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.7",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.6",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.7",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.6",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.7",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.6",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.7",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.6",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.7",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-667"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.34",
"versionEndExcluding": "5.15.190",
"matchCriteriaId": "B85A9468-F161-4294-956F-D3EC72C323A5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16",
"versionEndExcluding": "6.1.149",
"matchCriteriaId": "FDBE8280-8983-4D2D-943D-2E6D0104E2D8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.6.103",
"matchCriteriaId": "F2293654-7169-49B5-8D0D-EE51EF8B8E48"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.44",
"matchCriteriaId": "12351F24-1133-4775-960C-F2B47E81298B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.16.4",
"matchCriteriaId": "AFC28995-B8C3-4B68-8CB6-78E792B6629D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
"matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
"matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/34171b9e53bd1dc264f5556579f2b04f04435c73",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/43e281fde5e76a866a4d10780c35023f16c0e432",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/5bf5fce8a0c2a70d063af778fdb5b27238174cdd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/96476b043efb86a94f2badd260f7f99c97bd5893",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/bdb19cd0de739870bb3494c815138b9dc30875c4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/d1547bf460baec718b3398365f8de33d25c5f36f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
}
]
}