CVE-2026-99031
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup br_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL port groups by calling br_multicast_del_pg(). For S,G entries, that deletion calls back into br_multicast_sg_del_exclude_ports(), so a large number of STAR_EXCL ports consumes one kernel stack frame per port and can hit the stack guard page. Keep the complete port-group deletion path for cleanup, but suppress the S,G exclude-port cleanup while that helper is already walking the same entry. Normal deletion callers retain the existing behavior.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-10-23 13:17:26.190000
Last modified
2026-10-30 13:21:39.540000
View original CVE JSON
{
"id": "CVE-2026-99031",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-10-23T13:17:26.190",
"lastModified": "2026-10-30T13:21:39.540",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: avoid recursive multicast port cleanup\n\nbr_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL\nport groups by calling br_multicast_del_pg(). For S,G entries, that\ndeletion calls back into br_multicast_sg_del_exclude_ports(), so a large\nnumber of STAR_EXCL ports consumes one kernel stack frame per port and can\nhit the stack guard page.\n\nKeep the complete port-group deletion path for cleanup, but suppress the\nS,G exclude-port cleanup while that helper is already walking the same\nentry. Normal deletion callers retain the existing behavior."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"net/bridge/br_multicast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "8266a0491e92d39dc9af739e8380a0daa9b8836b",
"lessThan": "0ed8edcbcf2290dba13c1beeba27fc19ad38515b",
"versionType": "git",
"status": "affected"
},
{
"version": "8266a0491e92d39dc9af739e8380a0daa9b8836b",
"lessThan": "6a7385f6605958aa69eeb185c91f45d77640d1e2",
"versionType": "git",
"status": "affected"
},
{
"version": "8266a0491e92d39dc9af739e8380a0daa9b8836b",
"lessThan": "26142868b0767e95e28b7a1237f58b292b54d1d9",
"versionType": "git",
"status": "affected"
},
{
"version": "8266a0491e92d39dc9af739e8380a0daa9b8836b",
"lessThan": "695a5a4c69c922d9296b2d7ad5f1ce8c6858fc64",
"versionType": "git",
"status": "affected"
},
{
"version": "8266a0491e92d39dc9af739e8380a0daa9b8836b",
"lessThan": "2fb87c6025f90191516bee3ce14b42eb3e1cfed7",
"versionType": "git",
"status": "affected"
},
{
"version": "8266a0491e92d39dc9af739e8380a0daa9b8836b",
"lessThan": "d109141ba14652146089ef78b32d5e4d5285ebad",
"versionType": "git",
"status": "affected"
},
{
"version": "8266a0491e92d39dc9af739e8380a0daa9b8836b",
"lessThan": "7931fb9181421953f3133b408b0f2e2b8dd68b61",
"versionType": "git",
"status": "affected"
},
{
"version": "8266a0491e92d39dc9af739e8380a0daa9b8836b",
"lessThan": "5158353121bae4f552cb677ce8c5c3ef52f93a0d",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"net/bridge/br_multicast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.10",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.10",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.273",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.224",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.191",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.160",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.113",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.57",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.11",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ed8edcbcf2290dba13c1beeba27fc19ad38515b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/26142868b0767e95e28b7a1237f58b292b54d1d9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2fb87c6025f90191516bee3ce14b42eb3e1cfed7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5158353121bae4f552cb677ce8c5c3ef52f93a0d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/695a5a4c69c922d9296b2d7ad5f1ce8c6858fc64",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6a7385f6605958aa69eeb185c91f45d77640d1e2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7931fb9181421953f3133b408b0f2e2b8dd68b61",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d109141ba14652146089ef78b32d5e4d5285ebad",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}