CVE-2026-99031 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: avoid recursive multicast port cleanup
br_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL port groups by calling br_multicast_del_pg(). For S,G entries, that deletion calls back into br_multicast_sg_del_exclude_ports(), so a large number of STAR_EXCL ports consumes one kernel stack frame per port and can hit the stack guard page.
Keep the complete port-group deletion path for cleanup, but suppress the S,G exclude-port cleanup while that helper is already walking the same entry. Normal deletion callers retain the existing behavior.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel networking subsystem contains a critical vulnerability within its bridge multicast implementation, specifically involving recursive function calls during the cleanup of source-specific group exclusion ports. The issue resides in the br_multicast_sg_del_exclude_ports() routine, which is responsible for removing automatically added STAR_EXCL port groups by invoking br_multicast_del_pg(). However, when processing Source-Group or S,G entries, this deletion process inadvertently triggers a callback back into br_multicast_sg_del_exclude_ports(). This creates an unbounded recursive loop where each invocation consumes additional kernel stack space. In scenarios involving a large number of STAR_EXCL ports, the cumulative consumption of stack frames can exhaust the available kernel stack memory, leading to a violation of the stack guard page and resulting in a system crash or denial of service condition.
From a technical perspective, this flaw represents a classic case of uncontrolled recursion within kernel-space code paths that lack proper depth limiting mechanisms. The vulnerability arises because the cleanup logic for port groups does not account for the recursive nature of its own invocation when handling specific multicast entry types. As each S,G exclusion is processed, it triggers further deletions that re-enter the same function rather than iterating through a list or queue in an iterative manner. This design oversight means that under normal operational conditions with few ports, the system remains stable, but under stress or targeted manipulation involving many excluded sources, the kernel stack pointer rapidly approaches its limit. The resulting out-of-bounds access to memory beyond the allocated stack space typically causes a kernel panic, effectively halting all network processing on the affected host and potentially crashing the entire operating system instance depending on configuration and workload.
The operational impact of this vulnerability is significant for any environment relying on Linux bridge functionality with complex multicast configurations. Attackers or misconfigured applications can trigger the condition by rapidly adding and removing large numbers of source-specific multicast exclusions, thereby inducing a denial of service without requiring elevated privileges if the triggering action originates from user-space network stack interactions. This aligns with CWE-674, which describes uncontrolled recursion in functions that do not limit their depth, as well as CWE-121, involving stack-based buffer overflows resulting from excessive memory consumption on the call stack. In terms of adversarial tactics, this vulnerability could be leveraged within ATT&CK technique T1498, Network Denial of Service, by exploiting resource exhaustion through recursive kernel calls rather than simple bandwidth saturation.
Mitigation strategies primarily involve applying vendor-provided patches that update the Linux kernel to versions where the br_multicast_sg_del_exclude_ports() function has been refactored to prevent recursion. The fix typically involves maintaining a complete port-group deletion path for general cleanup while suppressing the specific S,G exclude-port cleanup logic when the helper is already traversing the same entry structure. This ensures that existing deletion callers retain their intended behavior without triggering recursive loops. Administrators should prioritize updating kernel packages on all systems utilizing bridge networking with multicast features enabled. Additionally, monitoring network interfaces for unusual patterns of rapid multicast group membership changes can help detect potential exploitation attempts before they trigger stack exhaustion events.