CVE-2026-31418
Logic Error in Linux Kernel netfilter ipset Bucket Handling
Publication date: 2026-04-13
Last updated on: 2026-05-20
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 5.6 |
| linux | linux_kernel | 5.6 |
| linux | linux_kernel | 5.6 |
| linux | linux_kernel | 5.6 |
| linux | linux_kernel | 5.6 |
| linux | linux_kernel | From 5.5.8 (inc) to 5.6 (exc) |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 5.11 (inc) to 5.15.203 (exc) |
| linux | linux_kernel | From 5.6.1 (inc) to 5.10.253 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.22 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.168 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.12 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.81 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.134 (exc) |
| linux | linux_kernel | From 5.4.24 (inc) to 5.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability in the Linux kernel's netfilter ipset component involves improper handling of logically empty buckets in the mtype_del function. It may cause the system to retain empty buckets longer than necessary, potentially leading to inefficient memory usage or resource management issues.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's netfilter ipset component, specifically in the function mtype_del(). The function is responsible for managing buckets of entries, but it incorrectly handles empty buckets. It only drops a bucket when both n->pos and k are zero, which causes it to miss buckets that have had all their live entries removed but where n->pos still points past deleted slots. The fix treats a bucket as empty when all positions below n->pos are unused and releases it directly instead of shrinking it further.