Linux kernel mm/vmalloc: BUG_ON fires when vmalloc is reached with bottom halves disabled

Impact

__get_vm_area_node() called BUG_ON(in_interrupt()), but in_interrupt() is also true when bottom halves are merely disabled. The bridge code reaches it through br_fdb_add_local() -> fdb_create() -> rhashtable_lookup_insert_fast() -> kvmalloc() -> vmalloc() while holding br->hash_lock with spin_lock_bh(), so a large enough rhashtable growth under that lock panics the host even though the caller is in neither NMI nor hard IRQ context. On a GPU node this is a full host kill, not a container kill: the bridge path is ordinary container and VM networking (docker0, CNI bridge, libvirt bridges), so it lands on exactly the hosts that carry tenant workloads. The reported trigger is a legitimate code path rather than a crafted attack, so treat this as a stability fix - the record does not establish tenant-reachable control over when it fires.

Who can reach it

Local, and indirect: anything that adds local FDB entries on a bridge (VLAN configuration, container or VM interface churn) can reach the path. No remote vector and no tenant-facing API is described in the record.

What to do

Patch the host kernel to a stable release carrying the two listed commits, which replace the in_interrupt() check with in_nmi() || in_hardirq(), then reboot each node; there is no runtime mitigation for a BUG_ON in the allocator. No fixed version numbers are given in the record - only the commit ids. Fold it into the next scheduled kernel rotation unless you are already seeing these panics on bridge-heavy hosts.

References

Related entries

• Linux kernel SCSI core: requeued commands never kicked, hanging device removal after host recoveryCVE-2026-64003 · Linux kernel SCSI core (scsi_run_host_queues device-state filter)High
• Linux kernel nvme-pci: dma_vec allocations leak on every peer-to-peer I/O completionCVE-2026-64020 · Linux kernel nvme-pci (dma_vec tracking for peer-to-peer DMA)High
• Linux kernel SMC-D client (CHID matching against unpopulated ism_dev slot): Slot 0 of the client's ISM device array isCVE-2026-64048 · Linux kernel SMC-D client (CHID matching against unpopulated ism_dev slot)High
• Linux kernel pcrypt: padata fallback leaves the parallel completion callback on the child requestCVE-2026-64312 · Linux kernel crypto pcrypt (padata -EBUSY fallback path)High
• Linux kernel RT scheduler: RT_PUSH_IPI can livelock a busy many-core node under softirq loadCVE-2026-64374 · Linux kernel RT scheduler (RT_PUSH_IPI pull logic on non-PREEMPT_RT kernels)High
• Linux kernel libceph: a monmap advertising zero monitors hits a BUG_ON and takes down the client nodeCVE-2026-68155 · Linux kernel libceph (ceph_monmap_decode, zero-monitor monmap)High