CVE-2026-31681
Improper Range Validation in Linux netfilter xt_multiport Module
Publication date: 2026-04-25
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by rejecting malformed multiport v1 rules in the Linux kernel's netfilter xt_multiport module. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's netfilter component, specifically in the xt_multiport module. The issue arises because the function ports_match_v1() incorrectly treats any non-zero pflags entry as the start of a port range and automatically consumes the next ports[] element as the range end without proper validation.
The checkentry path validates protocol, flags, and count but does not validate the range encoding itself. This allows malformed rules to either mark the last slot as a range start or place two range starts consecutively, causing ports_match_v1() to read beyond the last valid ports[] element when interpreting the rule.
The fix involves rejecting malformed multiport v1 rules by ensuring that each range start has a following element and that the following element is not itself marked as another range start.
How can this vulnerability impact me? :
This vulnerability in the Linux kernel's netfilter xt_multiport module can lead to improper handling of malformed port range rules. Specifically, the ports_match_v1() function may incorrectly interpret port ranges, potentially causing it to read beyond the last valid port element. This could result in unexpected behavior in firewall rule processing, which might affect network traffic filtering and security enforcement.