CVE-2026-31420: bridge: mrp: reject zero test interval to avoid OOM panic
In the Linux kernel, the following vulnerability has been resolved:
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1Fixed in 7.2.6-1Fixed in 7.2.7-1 - Configuration
Set both netlink attribute policies to NLA_POLICY_MIN(NLA_U32, 1) so zero test intervals are rejected before reaching workqueue scheduling.
Linux kernel bridge MRP netlink attribute parsing IFLA_BRIDGE_MRP_START_TEST_INTERVAL and IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL = NLA_POLICY_MIN(NLA_U32, 1)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31420?
CVE-2026-31420 is classified as a medium severity vulnerability due to its potential to cause an Out Of Memory (OOM) panic.
How do I fix CVE-2026-31420?
To resolve CVE-2026-31420, update your Linux kernel to the latest version where the vulnerability has been addressed.
What does CVE-2026-31420 affect?
CVE-2026-31420 affects the Linux kernel's bridge MRP functionality by improperly handling user-supplied interval values.
Can CVE-2026-31420 be exploited remotely?
CVE-2026-31420 may be exploited locally, as it requires user-supplied inputs to trigger the Out Of Memory condition.
What is the nature of CVE-2026-31420?
CVE-2026-31420 is a vulnerability that occurs when a zero interval is accepted, leading to potential resource exhaustion.