{"id":"CVE-2026-31681","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_multiport: validate range encoding in checkentry\n\nports_match_v1() treats any non-zero pflags entry as the start of a\nport range and unconditionally consu…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_multiport: validate range encoding in checkentry\n\nports_match_v1() treats any non-zero pflags entry as the start of a\nport range and unconditionally consu…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 2.6.17, < 6.6.136","linux_kernel >= 6.7, < 6.12.83","linux_kernel >= 6.13, < 6.18.24","linux_kernel >= 6.19, < 6.19.14","linux_kernel = 7.0"],"patched":["linux_kernel 6.19.14"],"published":"2026-04-25","updated":"2026-09-08","sourceUpdated":"2026-09-08T09:17:59.380","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-31681","references":[{"url":"https://git.kernel.org/stable/c/1e4baa853f1cc4227e04f52d6860524707cfb294","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/36bf0d98e180a7c384c8d8a59b0d2d4b80e5eb16","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8368ce8eb01f0b91111d814703696e780d0ef12f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c5bf8f5b478f569191c4a7982de7cd5f5f73c1a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aec14808271f2bf2b656de6ff12dfe73c5fd3b67","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b67d638cbee9975c765feb45c126e96ed11ec802","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9749f6232c845e31c21d4cc72200211df15d8a2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff64c5bfef12461df8450e0f50bb693b5269c720","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.0017,"epssPercentile":0.05712,"ingestedAt":"2026-09-08T09:30:09.793Z","slug":"CVE-2026-31681","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_multiport: validate range encoding in checkentry\n\nports_match_v1() treats any non-zero pflags entry as the start of a\nport range and unconditionally consumes the next ports[] element as\nthe range end.\n\nThe checkentry path currently validates protocol, flags and count, but\nit does not validate the range encoding itself. As a result, malformed\nrules can mark the last slot as a range start or place two range starts\nback to back, leaving ports_match_v1() to step past the last valid\nports[] element while interpreting the rule.\n\nReject malformed multiport v1 rules in checkentry by validating that\neach range start has a following element and that the following element\nis not itself marked as another range start.\n\n## Affected\n\n- `linux_kernel >= 2.6.17, < 6.6.136`\n- `linux_kernel >= 6.7, < 6.12.83`\n- `linux_kernel >= 6.13, < 6.18.24`\n- `linux_kernel >= 6.19, < 6.19.14`\n- `linux_kernel = 7.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.19.14`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}