Linux Kernel Vulnerability in Bridge MRP that Can Cause System Memory Exhaustion

CVE-2026-31420

What is CVE-2026-31420?

A vulnerability exists in the Linux kernel's bridge module, specifically in the MRP (Multiple Registration Protocol) implementation. The flaw arises when user-supplied interval values are accepted without appropriate validation, allowing an interval of zero to be provided. This leads to excessive allocation and transmission of MRP test frames, overwhelming system memory and triggering an out-of-memory (OOM) condition, which can result in a kernel panic. The proper mitigation involves using stricter validation rules within the netlink attribute parsing to reject zero intervals, preventing the system from entering a destructive loop that jeopardizes stability.

References