PT-2026-34400 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-31495

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the netfilter ctnetlink component where manual range and mask validations are used instead of netlink policy annotations. This can lead to undefined behavior when the CTA PROTOINFO TCP WSCALE ORIGINAL or CTA PROTOINFO TCP WSCALE REPLY variables are used as a u32 shift count because the ctnetlink path accepts values from 0 to 255, exceeding the maximum allowed TCP window scale of 14. Additionally, the system lacks policy-level rejection for values exceeding TCP CONNTRACK SYN SENT2 in CTA PROTOINFO TCP STATE and lacks proper mask validations for CTA FILTER ORIG FLAGS, CTA FILTER REPLY FLAGS, and CTA EXPECT FLAGS.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31495

Affected Products

Linux Kernel

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-31495 · Security Note
• https://git.kernel.org/stable/c/4f7d25f3f0786402ba48ff7d13b6241d77d975f5 · Note
• https://git.kernel.org/stable/c/c6cb41eaae875501eaaa487b8db6539feb092292 · Note
• https://git.kernel.org/stable/c/8f15b5071b4548b0aafc03b366eb45c9c6566704 · Note
• https://git.kernel.org/stable/c/2ef71307c86a9f866d6e28f1a0c06e2e9d794474 · Note
• https://git.kernel.org/stable/c/fcec5ce2d73a41668b24e3f18c803541602a59f6 · Note
• https://git.kernel.org/stable/c/675c913b940488a84effdeeac5a1cfb657b59804 · Note
• https://twitter.com/CVEnew/status/2046979983084584961 · Twitter Post
• https://git.kernel.org/stable/c/45c33e79ae705b7af97e3117672b6cd258dd0b1b · Note
• https://git.kernel.org/stable/c/435b576cd2faa75154777868f8cbb73bf71644d3 · Note