CVE-2026-99031

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99031", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.387Z", "datePublished": "2026-10-23T12:21:31.535Z", "dateUpdated": "2026-10-30T12:41:04.054Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:41:04.054Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: avoid recursive multicast port cleanup\n\nbr_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL\nport groups by calling br_multicast_del_pg(). For S,G entries, that\ndeletion calls back into br_multicast_sg_del_exclude_ports(), so a large\nnumber of STAR_EXCL ports consumes one kernel stack frame per port and can\nhit the stack guard page.\n\nKeep the complete port-group deletion path for cleanup, but suppress the\nS,G exclude-port cleanup while that helper is already walking the same\nentry. Normal deletion callers retain the existing behavior."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bridge/br_multicast.c"], "versions": [{"version": "8266a0491e92d39dc9af739e8380a0daa9b8836b", "lessThan": "0ed8edcbcf2290dba13c1beeba27fc19ad38515b", "status": "affected", "versionType": "git"}, {"version": "8266a0491e92d39dc9af739e8380a0daa9b8836b", "lessThan": "6a7385f6605958aa69eeb185c91f45d77640d1e2", "status": "affected", "versionType": "git"}, {"version": "8266a0491e92d39dc9af739e8380a0daa9b8836b", "lessThan": "26142868b0767e95e28b7a1237f58b292b54d1d9", "status": "affected", "versionType": "git"}, {"version": "8266a0491e92d39dc9af739e8380a0daa9b8836b", "lessThan": "695a5a4c69c922d9296b2d7ad5f1ce8c6858fc64", "status": "affected", "versionType": "git"}, {"version": "8266a0491e92d39dc9af739e8380a0daa9b8836b", "lessThan": "2fb87c6025f90191516bee3ce14b42eb3e1cfed7", "status": "affected", "versionType": "git"}, {"version": "8266a0491e92d39dc9af739e8380a0daa9b8836b", "lessThan": "d109141ba14652146089ef78b32d5e4d5285ebad", "status": "affected", "versionType": "git"}, {"version": "8266a0491e92d39dc9af739e8380a0daa9b8836b", "lessThan": "7931fb9181421953f3133b408b0f2e2b8dd68b61", "status": "affected", "versionType": "git"}, {"version": "8266a0491e92d39dc9af739e8380a0daa9b8836b", "lessThan": "5158353121bae4f552cb677ce8c5c3ef52f93a0d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bridge/br_multicast.c"], "versions": [{"version": "5.10", "status": "affected"}, {"version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0ed8edcbcf2290dba13c1beeba27fc19ad38515b"}, {"url": "https://git.kernel.org/stable/c/6a7385f6605958aa69eeb185c91f45d77640d1e2"}, {"url": "https://git.kernel.org/stable/c/26142868b0767e95e28b7a1237f58b292b54d1d9"}, {"url": "https://git.kernel.org/stable/c/695a5a4c69c922d9296b2d7ad5f1ce8c6858fc64"}, {"url": "https://git.kernel.org/stable/c/2fb87c6025f90191516bee3ce14b42eb3e1cfed7"}, {"url": "https://git.kernel.org/stable/c/d109141ba14652146089ef78b32d5e4d5285ebad"}, {"url": "https://git.kernel.org/stable/c/7931fb9181421953f3133b408b0f2e2b8dd68b61"}, {"url": "https://git.kernel.org/stable/c/5158353121bae4f552cb677ce8c5c3ef52f93a0d"}], "title": "net: bridge: avoid recursive multicast port cleanup", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bridge/br_multicast.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0ed8edcbcf2290dba13c1beeba27fc19ad38515b", "status": "affected", "version": "8266a0491e92d39dc9af739e8380a0daa9b8836b", "versionType": "git"}, {"lessThan": "6a7385f6605958aa69eeb185c91f45d77640d1e2", "status": "affected", "version": "8266a0491e92d39dc9af739e8380a0daa9b8836b", "versionType": "git"}, {"lessThan": "26142868b0767e95e28b7a1237f58b292b54d1d9", "status": "affected", "version": "8266a0491e92d39dc9af739e8380a0daa9b8836b", "versionType": "git"}, {"lessThan": "695a5a4c69c922d9296b2d7ad5f1ce8c6858fc64", "status": "affected", "version": "8266a0491e92d39dc9af739e8380a0daa9b8836b", "versionType": "git"}, {"lessThan": "2fb87c6025f90191516bee3ce14b42eb3e1cfed7", "status": "affected", "version": "8266a0491e92d39dc9af739e8380a0daa9b8836b", "versionType": "git"}, {"lessThan": "d109141ba14652146089ef78b32d5e4d5285ebad", "status": "affected", "version": "8266a0491e92d39dc9af739e8380a0daa9b8836b", "versionType": "git"}, {"lessThan": "7931fb9181421953f3133b408b0f2e2b8dd68b61", "status": "affected", "version": "8266a0491e92d39dc9af739e8380a0daa9b8836b", "versionType": "git"}, {"lessThan": "5158353121bae4f552cb677ce8c5c3ef52f93a0d", "status": "affected", "version": "8266a0491e92d39dc9af739e8380a0daa9b8836b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bridge/br_multicast.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"lessThan": "5.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: avoid recursive multicast port cleanup\n\nbr_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL\nport groups by calling br_multicast_del_pg(). For S,G entries, that\ndeletion calls back into br_multicast_sg_del_exclude_ports(), so a large\nnumber of STAR_EXCL ports consumes one kernel stack frame per port and can\nhit the stack guard page.\n\nKeep the complete port-group deletion path for cleanup, but suppress the\nS,G exclude-port cleanup while that helper is already walking the same\nentry. Normal deletion callers retain the existing behavior."}], "id": "CVE-2026-99031", "lastModified": "2026-10-30T13:21:39.540", "metrics": {}, "published": "2026-10-23T13:17:26.190", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0ed8edcbcf2290dba13c1beeba27fc19ad38515b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/26142868b0767e95e28b7a1237f58b292b54d1d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2fb87c6025f90191516bee3ce14b42eb3e1cfed7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5158353121bae4f552cb677ce8c5c3ef52f93a0d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/695a5a4c69c922d9296b2d7ad5f1ce8c6858fc64"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6a7385f6605958aa69eeb185c91f45d77640d1e2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7931fb9181421953f3133b408b0f2e2b8dd68b61"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d109141ba14652146089ef78b32d5e4d5285ebad"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: bridge: avoid recursive multicast port cleanup", "id": "2559754", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559754"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: bridge: avoid recursive multicast port cleanup\nbr_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL\nport groups by calling br_multicast_del_pg(). For S,G entries, that\ndeletion calls back into br_multicast_sg_del_exclude_ports(), so a large\nnumber of STAR_EXCL ports consumes one kernel stack frame per port and can\nhit the stack guard page.\nKeep the complete port-group deletion path for cleanup, but suppress the\nS,G exclude-port cleanup while that helper is already walking the same\nentry. Normal deletion callers retain the existing behavior.", "A flaw was found in the Linux kernel's network bridge subsystem. When cleaning up multicast port entries, the kernel executes recursive function calls that consume a new stack frame for each port being removed. An attacker capable of triggering the removal of a large number of multicast ports can exhaust kernel stack memory and cause a system crash, resulting in a denial of service (DoS)."], "name": "CVE-2026-99031", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99031\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99031\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99031.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8266a0491e92d39dc9af739e8380a0daa9b8836b,695a5a4c69c922d9296b2d7ad5f1ce8c6858fc64)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8266a0491e92d39dc9af739e8380a0daa9b8836b,2fb87c6025f90191516bee3ce14b42eb3e1cfed7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8266a0491e92d39dc9af739e8380a0daa9b8836b,d109141ba14652146089ef78b32d5e4d5285ebad)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8266a0491e92d39dc9af739e8380a0daa9b8836b,7931fb9181421953f3133b408b0f2e2b8dd68b61)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8266a0491e92d39dc9af739e8380a0daa9b8836b,5158353121bae4f552cb677ce8c5c3ef52f93a0d)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8266a0491e92d39dc9af739e8380a0daa9b8836b,695a5a4c69c922d9296b2d7ad5f1ce8c6858fc64)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8266a0491e92d39dc9af739e8380a0daa9b8836b,2fb87c6025f90191516bee3ce14b42eb3e1cfed7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8266a0491e92d39dc9af739e8380a0daa9b8836b,d109141ba14652146089ef78b32d5e4d5285ebad)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8266a0491e92d39dc9af739e8380a0daa9b8836b,7931fb9181421953f3133b408b0f2e2b8dd68b61)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8266a0491e92d39dc9af739e8380a0daa9b8836b,5158353121bae4f552cb677ce8c5c3ef52f93a0d)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T15:15:14.433127+00:00", "updated": "2026-10-29T19:15:08.623685+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}