In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup… (CVE-2026-99031)

The Linux kernel vulnerability CVE-2026-99031 involves recursive calls in the multicast port cleanup logic within the network bridge code. Specifically, br_multicast_sg_del_exclude_ports() calls br_multicast_del_pg() to remove STAR_EXCL port groups, which for S,G entries calls back into br_multicast_sg_del_exclude_ports(), causing deep recursion proportional to the number of STAR_EXCL ports. This recursion can exhaust kernel stack space and hit the stack guard page, leading to potential kernel instability or crashes. The patch modifies the cleanup path to suppress recursive exclude-port cleanup when already processing the same entry, preventing stack exhaustion while preserving normal deletion behavior.

This vulnerability can cause kernel stack exhaustion due to unbounded recursion in multicast port cleanup, potentially leading to kernel crashes or denial of service. There is no information about exploitation in the wild or other impacts such as privilege escalation.

A fix has been implemented in the Linux kernel to address this issue by suppressing recursive exclude-port cleanup during the same entry walk. Users should apply the official Linux kernel update that includes this patch to remediate the vulnerability. No additional mitigation steps are indicated.