Critical Soft Lockup Vulnerability in Linux Kernel - CVE-2025-39773
Summary
CVE-2025-39773: In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix soft lockup in br_multicast_query_expired() When set multicast_query_interval to a large value, the local variable 'time' in br_multica... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of functionalities, including process management, memory management, and networking. The kernel is crucial for system stability and performance, making it vital to address any vulnerabilities that may arise.
Vulnerability Detail
CVE-2025-39773 is a vulnerability in the Linux kernel related to the bridge networking subsystem. It arises when the multicast_query_interval is set to an excessively large value, causing a local variable 'time' in the br_multicast_send_query() function to overflow. This overflow can lead to immediate timer expiration and a loop that triggers a soft lockup, resulting in system instability. The issue can be reproduced by configuring a bridge interface with specific parameters, leading to potential denial of service due to CPU resource exhaustion.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid setting the multicast_query_interval to a large value. Instead, configure it to a reasonable value to prevent the overflow issue. For example, execute the following commands to set a safe interval: 'echo 1000 > /sys/class/net/br0/bridge/multicast_query_interval'.
Conclusion
CVE-2025-39773 presents a significant risk to systems running affected versions of the Linux kernel. It is crucial for users to update their systems promptly and consider the provided workarounds to maintain system stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-39773 is a vulnerability in the Linux kernel that can cause a soft lockup when the multicast_query_interval is set too high.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The primary symptom is a soft lockup, where the CPU becomes unresponsive for an extended period, potentially leading to system crashes.
Yes, a patch has been released. Users should update their Linux kernel to the latest version to mitigate the vulnerability.
If immediate updates are not possible, consider applying the suggested workaround by setting a safe multicast_query_interval to prevent the overflow issue.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
