- —Not scoredno CVSS score yet
- 0.18%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup br_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL port groups by calling br_multicast_del_pg(). For S,G entries, that deletion calls back into br_multicast_sg_del_exclude_ports(), so a large number of STAR_EXCL ports consumes one kernel stack frame per port and can hit the stack guard page. Keep the complete port-group deletion path for cleanup, but suppress the S,G exclude-port cleanup while that helper is already walking the same entry. Normal deletion callers retain the existing behavior.
Timeline
ID reserved
By Linux
- 28 days later
· 28 days later
Published
- 7 days later
· 7 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.18% · top 93% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 8266a0491e92d39dc9af739e8380a0daa9b8836b – < 0ed8edcbcf2290dba13c1beeba27fc19ad38515b
- affected 8266a0491e92d39dc9af739e8380a0daa9b8836b – < 6a7385f6605958aa69eeb185c91f45d77640d1e2
- affected 8266a0491e92d39dc9af739e8380a0daa9b8836b – < 26142868b0767e95e28b7a1237f58b292b54d1d9
- affected 8266a0491e92d39dc9af739e8380a0daa9b8836b – < 695a5a4c69c922d9296b2d7ad5f1ce8c6858fc64
- affected 8266a0491e92d39dc9af739e8380a0daa9b8836b – < 2fb87c6025f90191516bee3ce14b42eb3e1cfed7
- affected 8266a0491e92d39dc9af739e8380a0daa9b8836b – < d109141ba14652146089ef78b32d5e4d5285ebad
- affected 8266a0491e92d39dc9af739e8380a0daa9b8836b – < 7931fb9181421953f3133b408b0f2e2b8dd68b61
- affected 8266a0491e92d39dc9af739e8380a0daa9b8836b – < 5158353121bae4f552cb677ce8c5c3ef52f93a0d
- affected 5.10
- unaffected < 5.10
- unaffected 5.10.273 – ≤ 5.10.*
- unaffected 5.15.224 – ≤ 5.15.*
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.113 – ≤ 6.12.*
- unaffected 6.18.57 – ≤ 6.18.*
- unaffected 7.2.11 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/0ed8edcbcf2290dba13c1beeba27fc19ad38515b (opens in a new tab)
- https://git.kernel.org/stable/c/6a7385f6605958aa69eeb185c91f45d77640d1e2 (opens in a new tab)
- https://git.kernel.org/stable/c/26142868b0767e95e28b7a1237f58b292b54d1d9 (opens in a new tab)
- https://git.kernel.org/stable/c/695a5a4c69c922d9296b2d7ad5f1ce8c6858fc64 (opens in a new tab)
- https://git.kernel.org/stable/c/2fb87c6025f90191516bee3ce14b42eb3e1cfed7 (opens in a new tab)
- https://git.kernel.org/stable/c/d109141ba14652146089ef78b32d5e4d5285ebad (opens in a new tab)
- https://git.kernel.org/stable/c/7931fb9181421953f3133b408b0f2e2b8dd68b61 (opens in a new tab)
- https://git.kernel.org/stable/c/5158353121bae4f552cb677ce8c5c3ef52f93a0d (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-108826 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-99031)Record last updated .