PT-2026-32344 · Linux · Linux Kernel

Published 2026-04-13 · Updated 2026-05-26 · CVE-2026-31418

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the netfilter ipset component where the mtype del() function fails to drop logically empty buckets. The function counts empty slots below n->pos in k, but only drops the bucket when both n->pos and k are zero. This results in buckets not being released when all live entries are removed while n->pos still points past deleted slots.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31418

ECHO-DFAB-9B18-1D6D

OESA-2026-2232

OESA-2026-2235

OESA-2026-2236

Affected Products

Linux Kernel

References · 36

• https://git.kernel.org/stable/c/58f3a14826d4e6b0d5421f1a64be280b48601ea2 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-31418 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-31418 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31418 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-31418 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-31418 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2235 · Vendor Advisory
• https://git.kernel.org/stable/c/b7eef00f08b92b0b9efe8ae0df6d0005e6199323 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31418 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71089 · Security Note
• https://ubuntu.com/security/CVE-2026-31418 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31418 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2236 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31420 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31680 · Security Note