CVE-2026-31681

Vulnerability

Analysis

The Linux kernel's netfilter xt_multiport module contains a vulnerability in its checkentry validation path. The ports_match_v1() function interprets any non-zero pflags entry as the start of a port range and unconditionally consumes the next ports[] element as the range end. However, checkentry only validates protocol, flags, and count but does not validate the range encoding itself. This allows malformed rules that mark the last slot as a range start or place two range starts consecutively, causing ports_match_v1() to step past the last valid ports[] element while interpreting the rule [1].

Exploitation

The attack surface is limited to users or processes with the capability to load custom netfilter rules, typically requiring root privileges or CAP_NET_ADMIN. An attacker with such privileges can craft a malformed multiport v1 rule that triggers the out-of-bounds access. No authentication beyond the required capabilities is needed, as the flaw occurs during rule loading before any packet matching.

Impact

Successful exploitation results in an out-of-bounds memory access within the kernel, which can lead to denial of service (kernel panic or crash). In some configurations, this could potentially enable privilege escalation or information disclosure, though the primary impact is system instability.

Mitigation

The fix adds validation in checkentry to reject malformed multiport v1 rules by ensuring that each range start has a following element and that the following element is not itself a range start. The patch has been merged into the stable Linux kernel tree addresses this issue [2][3][4]. Users should apply the latest kernel updates to remediate the vulnerability.