CVE-2026-31681: netfilter: xt_multiport: validate range encoding in checkentry
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xtmultiport: validate range encoding in checkentry
portsmatchv1() treats any non-zero pflags entry as the start of a port range and unconditionally consumes the next ports[] element as the range end.
The checkentry path currently validates protocol, flags and count, but it does not validate the range encoding itself. As a result, malformed rules can mark the last slot as a range start or place two range starts back to back, leaving portsmatchv1() to step past the last valid ports[] element while interpreting the rule.
Reject malformed multiport v1 rules in checkentry by validating that each range start has a following element and that the following element is not itself marked as another range start.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31681?
CVE-2026-31681 is classified as a potential denial-of-service vulnerability in the netfilter xt_multiport module of the Linux kernel.
How do I fix CVE-2026-31681?
To fix CVE-2026-31681, upgrade the Linux kernel to a version that includes the security patch for this vulnerability.
Which Linux kernel versions are affected by CVE-2026-31681?
CVE-2026-31681 affects certain versions of the Linux kernel that utilize the netfilter xt_multiport module.
What impact does CVE-2026-31681 have on system security?
CVE-2026-31681 can lead to denial-of-service conditions, affecting the availability of services on the impacted system.
Is CVE-2026-31681 being exploited in the wild?
As of the latest updates, there have been no confirmed reports of exploitation of CVE-2026-31681 in the wild.