CVE-2026-31420 bridge: mrp: reject zero test interval to avoid OOM panic
A local attacker can trigger a kernel panic and memory exhaustion by setting a zero MRP test interval in the Linux kernel bridge module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31420?
CVE-2026-31420 is a medium-severity denial of service vulnerability in Linux kernel, published on 13 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bridge: mrp: reject zero test interval to avoid OOM panic
br_mrp_start_test() and br_mrp_start_in_test() accept the user-supplied interval value from netlink without validation. When interval is 0, usecs_to_jiffies(0) yields 0, causing the delayed work (br_mrp_test_work_expired / br_mrp_in_test_work_expired) to reschedule itself with zero delay. This creates a tight loop on system_percpu_wq that allocates and transmits MRP test frames at maximum rate, exhausting all system memory and causing a kernel panic via OOM deadlock.
The same zero-interval issue applies to br_mrp_start_in_test_parse() for interconnect test frames.
Use NLA_POLICY_MIN(NLA_U32, 1) in the nla_policy tables for both IFLA_BRIDGE_MRP_START_TEST_INTERVAL and IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL, so zero is rejected at the netlink attribute parsing layer before the value ever reaches the workqueue scheduling code. This is consistent with how other bridge subsystems (br_fdb, br_mst) enforce range constraints on netlink attributes.
Weakness: CWE-667
Which versions are affected by CVE-2026-31420?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31420?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-31420 being exploited?
There is no known exploitation of CVE-2026-31420 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31420, DEBIAN-CVE-2026-31420, GHSA-644j-vc34-vf98, ROOT-OS-DEBIAN-11-CVE-2026-31420, ROOT-OS-DEBIAN-12-CVE-2026-31420, ROOT-OS-DEBIAN-13-CVE-2026-31420 and 3 more.