{"id":"CVE-2026-99031","kind":"vulnerability","aliases":["CVE-2026-99031"],"related":[],"title":"Linux kernel bridge: multicast cleanup recursion can exhaust kernel stack","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: avoid recursive multicast port cleanup\n\nbr_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL\nport groups by calling br_multicast_del_pg(). For S,G entries, that\ndeletion calls back into br_multicast_sg_del_exclude_ports(), so a large\nnumber of STAR_EXCL ports consumes one kernel stack frame per port and can\nhit the stack guard page.\n\nKeep the complete port-group deletion path for cleanup, but suppress the\nS,G exclude-port cleanup while that helper is already walking the same\nentry. Normal deletion callers retain the existing behavior.","summary":"Removing many automatically added multicast exclude-port groups on a Linux bridge recurses once per port, consuming one kernel stack frame each. With enough ports this hits the stack guard page and can crash the kernel.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bridge","infrastructure","kernel","linux","multicast"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T13:17:26+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:23+00:00","updated_at":"2026-10-25T04:54:23+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T04:54:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel bridge: multicast cleanup recursion can exhaust kernel stack","impact":"low","summary":"Removing many automatically added multicast exclude-port groups on a Linux bridge recurses once per port, consuming one kernel stack frame each. With enough ports this hits the stack guard page and can crash the kernel.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","bridge","multicast"],"confidence":0.4,"needs_auth":"unknown","worst_case":"kernel stack overflow crashes the host, denial of service","analyst_note":"Check the NVD entry and the upstream kernel stable commit for affected kernel version ranges and the fixed versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000516,"input_tokens":3451,"output_tokens":342,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-99031':13A,16A 'add':25B,84C 'alreadi':155C 'automat':24B,83C 'avoid':71C 'back':102C 'behavior':166C 'br':76C,91C,104C 'bridg':3A,17B,34B,70C 'call':90C,101C 'caller':162C 'cleanup':5A,75C,141C,150C 'complet':134C 'consum':39B,118C 'crash':56B 'cve':11A,14A 'del':79C,93C,107C 'delet':100C,138C,161C 'enough':46B 'entri':98C,159C 'excl':86C,116C 'exclud':28B,80C,108C,148C 'exclude-port':27B,147C 'exhaust':8A 'exist':165C 'follow':64C 'frame':43B,122C 'g':97C,146C 'group':30B,88C,137C 'guard':52B,130C 'helper':153C 'hit':49B,127C 'infrastructur':18B 'keep':132C 'kernel':2A,9A,19B,41B,58B,62C,120C 'larg':112C 'linux':1A,20B,33B,61C 'mani':23B 'multicast':4A,21B,26B,73C,77C,92C,105C 'net':69C 'normal':160C 'number':113C 'one':40B,119C 'page':53B,131C 'path':139C 'per':37B,123C 'pg':94C 'port':29B,38B,47B,74C,81C,87C,109C,117C,124C,136C,149C 'port-group':135C 'recurs':6A,35B,72C 'remov':22B,82C 'resolv':68C 'retain':163C 'sg':78C,106C 'stack':10A,42B,51B,121C,129C 'star':85C,115C 'suppress':143C 'vulner':65C 'walk':156C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99031","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99031","severity":null,"published_at":"2026-10-23T13:17:26+00:00","modified_at":"2026-10-23T13:17:26+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}