CVE-2026-99031 net: bridge: avoid recursive multicast port cleanup

Not scored Published 23 Oct 2026 Updated 23 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-99031?

CVE-2026-99031 is a vulnerability in Linux, published on 23 Oct 2026.

Official description

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: avoid recursive multicast port cleanup

br_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL port groups by calling br_multicast_del_pg(). For S,G entries, that deletion calls back into br_multicast_sg_del_exclude_ports(), so a large number of STAR_EXCL ports consumes one kernel stack frame per port and can hit the stack guard page.

Keep the complete port-group deletion path for cleanup, but suppress the S,G exclude-port cleanup while that helper is already walking the same entry. Normal deletion callers retain the existing behavior.

Which versions are affected by CVE-2026-99031?

How do I fix CVE-2026-99031?

Upgrade to a fixed version.

Is CVE-2026-99031 being exploited?

There is no known exploitation of CVE-2026-99031 in the wild and no public exploit code.

Sources

Also known as AZL-110888, BELL-CVE-2026-99031, DEBIAN-CVE-2026-99031, GHSA-c83g-q254-qmxr, UBUNTU-CVE-2026-99031.