CVE-2026-99031

What it actually does

Recursive invocation of br_multicast_sg_del_exclude_ports via br_multicast_del_pg for S,G entries with many STAR_EXCL ports exhausts kernel stack frames until the guard page is hit.

Why it matters to the business

Systems using Linux bridging with multicast may experience kernel stack overflow leading to crashes or denial of service; low exploit probability but high impact if triggered on production routers or hypervisors.

How an attack unfolds

An attacker configures a large number of multicast group exclusions on a bridge interface to force repeated recursive calls during port cleanup, consuming stack space until the guard page triggers a kernel panic.

How to fix it

Apply the upstream kernel patch that suppresses recursive S,G exclude-port cleanup while the helper walks the same entry; rebuild and deploy the fixed kernel image.

How to confirm the fix worked

Confirm the patch is present by inspecting the bridge multicast code for the recursion guard; test bridge multicast group addition and deletion under load to verify no stack growth.

Typical attack path

1. Attach to or create a Linux bridge interface with multicast enabled
2. Add a large set of S,G multicast entries triggering STAR_EXCL port groups
3. Trigger deletion paths that invoke br_multicast_sg_del_exclude_ports
4. Cause repeated recursion until stack guard page violation

How to detect it

Review kernel logs for oops or panic messages referencing br_multicast_sg_del_exclude_ports or stack guard violations on systems with active bridge multicast; no authenticated exploitation artifacts are known.

What your security team should do

• Prioritize kernel upgrade on any system exposing bridge multicast interfaces
• Monitor for kernel oops or stack overflow reports involving br_multicast functions
• Limit multicast configuration exposure on untrusted interfaces until patched