Linux kernel: netfilter xt_multiport range validation flaw
CVE-2026-31681 Published on April 25, 2026
netfilter: xt_multiport: validate range encoding in checkentry
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_multiport: validate range encoding in checkentry
ports_match_v1() treats any non-zero pflags entry as the start of a
port range and unconditionally consumes the next ports[] element as
the range end.
The checkentry path currently validates protocol, flags and count, but
it does not validate the range encoding itself. As a result, malformed
rules can mark the last slot as a range start or place two range starts
back to back, leaving ports_match_v1() to step past the last valid
ports[] element while interpreting the rule.
Reject malformed multiport v1 rules in checkentry by validating that
each range start has a following element and that the following element
is not itself marked as another range start.
Products Associated with CVE-2026-31681
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version a89ecb6a2ef732d04058d87801e2b6bd7e5c7089 and below aec14808271f2bf2b656de6ff12dfe73c5fd3b67 is affected.
- Version a89ecb6a2ef732d04058d87801e2b6bd7e5c7089 and below 8368ce8eb01f0b91111d814703696e780d0ef12f is affected.
- Version a89ecb6a2ef732d04058d87801e2b6bd7e5c7089 and below 1e4baa853f1cc4227e04f52d6860524707cfb294 is affected.
- Version a89ecb6a2ef732d04058d87801e2b6bd7e5c7089 and below ff64c5bfef12461df8450e0f50bb693b5269c720 is affected.
- Version 2.6.17 is affected.
- Before 2.6.17 is unaffected.
- Version 6.12.83, <= 6.12.* is unaffected.
- Version 6.18.24, <= 6.18.* is unaffected.
- Version 6.19.14, <= 6.19.* is unaffected.
- Version 7.0, <= * is unaffected.