CVE-2026-99031: Linux kernel · net: bridge: avoid recursive multicast port cleanup
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in d109141ba14652146089ef78b32d5e4d5285ebad : update Linux kernel when convenient.
Data as of 26 Oct 2026, 13:07 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in d109141ba14652146089ef78b32d5e4d5285ebad, 5158353121bae4f552cb677ce8c5c3ef52f93a0d, 7931fb9181421953f3133b408b0f2e2b8dd68b61 +2
Exploitation evidence
Disclosed: evidence found.
CVE published 23 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available in the Linux kernel as indicated by the fixed commit versions. Users should update to a kernel version that includes the fix identified by the commits d109141ba14652146089ef78b32d5e4d5285ebad, 5158353121bae4f552cb677ce8c5c3ef52f93a0d, 7931fb9181421953f3133b408b0f2e2b8dd68b61, 695a5a4c69c922d9296b2d7ad5f1ce8c6858fc64, or 2fb87c6025f90191516bee3ce14b42eb3e1cfed7. No additional mitigation steps are indicated.
Description
CVE-2026-99031 is a vulnerability in the Linux kernel's network bridge code where recursive multicast port cleanup can lead to excessive kernel stack usage. The issue arises because the deletion of certain multicast port groups calls back into the cleanup function recursively, consuming one kernel stack frame per port and potentially hitting the stack guard page. This vulnerability has been fixed by suppressing the recursive cleanup during the traversal of the same entry while maintaining normal deletion behavior for other callers.
References
- git.kernel.org/stable/c/695a5a4c69c922d9296b2d7ad5f1ce8c6858fc64 (opens in a new tab)
- git.kernel.org/stable/c/2fb87c6025f90191516bee3ce14b42eb3e1cfed7 (opens in a new tab)
- git.kernel.org/stable/c/d109141ba14652146089ef78b32d5e4d5285ebad (opens in a new tab)
- git.kernel.org/stable/c/7931fb9181421953f3133b408b0f2e2b8dd68b61 (opens in a new tab)
- git.kernel.org/stable/c/5158353121bae4f552cb677ce8c5c3ef52f93a0d (opens in a new tab)