# CVE-2026-63988: linux: In the Linux kernel, the following vulnerability has been resolved: bridge: Fix sleep in atomic context in sysfs pat... CVE-2026-63988 is fixed in 20 products on 1 platform, first by ALAS2023-2026-1881, released June 22, 2026. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2026-63988 - Priority: Routine - CVSS: 5.5 (medium) - EPSS: 0.0012 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jun 22, 2026 ## Description In the Linux kernel, the following vulnerability has been resolved: bridge: Fix sleep in atomic context in sysfs path Since the start of the git history, brport_store() always acquired the bridge lock. Back then this decision made sense: The bridge lock protects the STP state of the bridge and its ports and at that time the function was only used by two STP related attributes (cost and priority). Nowadays, brport_store() processes a lot more attributes and most of them do not need the bridge lock: * Bridge flags: Only require RTNL. Read locklessly by the data path. Annotations can be added in net-next. * FDB port flushing: Only requires the FDB lock. * Multicast attributes: Only require the multicast lock. * Group forward mask: Only requires RTNL. Read locklessly by the data path. Annotations can be added in net-next. * Backup port: Only requires RTNL. Read locklessly by the data path. This is a problem as the bridge calls dev_set_promiscuity() when certain bridge port flags change and this function can sleep since the commit cited below, resulting in a splat such as [1]. Fix this by reducing the scope of the bridge lock and only take it when processing the two STP related attributes that require it. Remove the now stale comment from br_switchdev_set_port_flag(). The SWITCHDEV_F_DEFER flag can be removed in net-next. [1] BUG: sleeping function called from invalid context at net/core/dev_addr_lists.c:1262 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 372, name: bash preempt_count: 201, expected: 0 RCU nest depth: 0, expected: 0 5 locks held by bash/372: #0: ffff88810c51c3f0 (sb_writers#7){.+.+}-{0:0}, at: ksys_write (fs/read_write.c:740) #1: ffff888115ce9480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter (fs/kernfs/file.c:343) #2: ffff88810b9fd330 (kn->active#37){.+.+}-{0:0}, at: kernfs_fop_write_iter (fs/kernfs/file.c:80 fs/kernfs/file.c:344) #3: ffffffffa59473a0 (rtnl_mutex){+.+.}-{4:4}, at: brport_store (net/bridge/br_sysfs_if.c:326) #4: ffff8881099d2d58 (&br->lock){+...}-{3:3}, at: brport_store (./include/linux/spinlock.h:348 net/bridge/br_sysfs_if.c:345) Preemption disabled at: 0x0 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) __might_resched.cold (kernel/sched/core.c:9163) netif_rx_mode_run (net/core/dev_addr_lists.c:1262) netif_rx_mode_sync (net/core/dev_addr_lists.c:1428) dev_set_promiscuity (net/core/dev_api.c:289) br_manage_promisc (net/bridge/br_if.c:135 net/bridge/br_if.c:172) br_port_flags_change (net/bridge/br_if.c:242 net/bridge/br_if.c:747) store_learning (net/bridge/br_sysfs_if.c:79 net/bridge/br_sysfs_if.c:235) brport_store (net/bridge/br_sysfs_if.c:346) kernfs_fop_write_iter (fs/kernfs/file.c:352) new_sync_write (fs/read_write.c:595) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | bpftool6.18 amzn 2023 | 1:6.18.35-68.127.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | | Linux | bpftool6.18-debuginfo amzn 2023 | 1:6.18.35-68.127.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | | Linux | kernel-livepatch-6.18.35-68.127 amzn 2023 | 1:1.0-0.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | | Linux | kernel6.18 amzn 2023 | 1:6.18.35-68.127.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | | Linux | kernel6.18-debuginfo amzn 2023 | 1:6.18.35-68.127.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | | Linux | kernel6.18-debuginfo-common-aarch64 amzn 2023 | 1:6.18.35-68.127.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | | Linux | kernel6.18-debuginfo-common-x86_64 amzn 2023 | 1:6.18.35-68.127.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | | Linux | kernel6.18-devel amzn 2023 | 1:6.18.35-68.127.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | | Linux | kernel6.18-headers amzn 2023 | 1:6.18.35-68.127.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | | Linux | kernel6.18-modules-extra amzn 2023 | 1:6.18.35-68.127.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | | Linux | kernel6.18-modules-extra-common amzn 2023 | 1:6.18.35-68.127.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | | Linux | kernel6.18-tools amzn 2023 | 1:6.18.35-68.127.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | | Linux | kernel6.18-tools-debuginfo amzn 2023 | 1:6.18.35-68.127.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | | Linux | kernel6.18-tools-devel amzn 2023 | 1:6.18.35-68.127.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | | Linux | linux Debian 14 | 7.0.12-1 | [DEBIAN-CVE-2026-63988](https://patchblox.com/security/data/fix/linux/debian-cve-2026-63988.md) | Jul 20, 2026 | | Linux | microvm-kernel6.18 amzn 2023 | 1:6.18.35-68.127.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | | Linux | perf6.18 amzn 2023 | 1:6.18.35-68.127.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | | Linux | perf6.18-debuginfo amzn 2023 | 1:6.18.35-68.127.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | | Linux | python3-perf6.18 amzn 2023 | 1:6.18.35-68.127.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | | Linux | python3-perf6.18-debuginfo amzn 2023 | 1:6.18.35-68.127.amzn2023 | [ALAS2023-2026-1881](https://patchblox.com/security/data/fix/linux/alas2023-2026-1881.md) | Jun 22, 2026 | --- Data as of 2026-11-10T20:03:11Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.