The bug in the Linux kernel's bridge multicast code causes an unintended recursive call that consumes a distinct kernel stack frame per excluded port. A large number of STAR_EXCL ports can push the recursion beyond the stack guard page, leading to a stack guard page hit and a kernel crash. The impact is a denial of service via kernel panic.

All Linux kernel distributions that include the net:bridge multicast code prior to the commit that added recursion suppression are vulnerable. The issue affects the Linux kernel itself, and no specific versions are listed, so any kernel that has not yet incorporated the change is potentially impacted.

The risk is primarily a crash of the kernel leading to a DoS. The CVSS score is 5.5, indicating medium severity. The EPSS score is < 1%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to trigger the multicast port cleanup path, which is typically done by sending multicast traffic that poses many STAR_EXCL ports to the bridge, a scenario that could be achieved from the network side. Therefore, the likelihood of exploitation is low but the impact of a successful trigger is high as it results in service disruption.