CVE-2025-39773

What it actually does

Integer overflow in br_multicast_send_query() time calculation when multicast_query_interval (or multicast_startup_query_interval) exceeds maximum, causing immediate timer re-arming loop in br_multicast_query_expired() and soft lockup.

Why it matters to the business

Systems using Linux bridge multicast querier become unresponsive under attacker-controlled configuration, leading to denial of service on servers, containers, or network appliances; high urgency for organizations running unpatched kernels given 411 days since disclosure.

How an attack unfolds

Local attacker with privileges to modify bridge sysfs values enables multicast_querier and writes maximum value to multicast_query_interval, triggering repeated immediate timer callbacks that exhaust CPU and produce watchdog soft lockup; listed actors VMSCAPE and container-focused campaigns may leverage similar kernel timer flaws for escalation on Container-Optimized OS.

How to fix it

Upgrade Linux kernel to commit 34171b9e53bd1dc264f5556579f2b04f04435c73 or later stable releases containing the query-interval maximum check; avoid setting multicast_query_interval to extreme values until patched.

How to confirm the fix worked

Confirm presence of the maximum-value enforcement patch in kernel source; reproduce the ip-link and sysfs sequence on a test bridge and verify absence of immediate re-arming or soft-lockup messages.

Typical attack path

1. Obtain local user or container access
2. Create or select bridge interface
3. Enable multicast_querier via sysfs
4. Write 0xffffffffffffffff to multicast_query_interval
5. Trigger timer softirq to induce lockup

How to detect it

Search kernel logs and dmesg for soft lockup watchdog messages, br_multicast_query_expired call traces, and rb_consumer process activity; correlate with sysfs writes to multicast_query_interval on bridge interfaces.

• soft lockup - CPU
• br_multicast_query_expired
• br_multicast_send_query
• multicast_query_interval
• rb_consumer

What your security team should do

• Prioritize kernel upgrades to the listed fixed commit across all fleets
• Restrict unprivileged modification of bridge multicast sysfs entries via SELinux/AppArmor or capabilities
• Monitor kernel logs for soft-lockup entries mentioning br_multicast_query_expired
• Audit bridge configurations for non-default multicast_query_interval values