PT-2026-35141 · Linux · Linux Kernel

Published 2026-04-25 · Updated 2026-05-26 · CVE-2026-31681

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the netfilter xt multiport component where the checkentry path fails to validate range encoding. The ports match v1() function treats any non-zero pflags entry as the start of a port range and automatically consumes the subsequent ports[] element as the range end. Because the validation process does not verify the range encoding, malformed rules can designate the final slot as a range start or place two range starts consecutively. This allows ports match v1() to read beyond the last valid ports[] element while interpreting the rule.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31681

ECHO-D153-97F2-271D

Affected Products

Linux Kernel

References · 20

• https://git.kernel.org/stable/c/aec14808271f2bf2b656de6ff12dfe73c5fd3b67 · Patch
• https://git.kernel.org/stable/c/1e4baa853f1cc4227e04f52d6860524707cfb294 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31681 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-31681 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31681 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31681 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31681 · Security Note
• https://ubuntu.com/security/CVE-2026-31681 · Vendor Advisory
• https://git.kernel.org/stable/c/ff64c5bfef12461df8450e0f50bb693b5269c720 · Patch
• https://git.kernel.org/stable/c/8368ce8eb01f0b91111d814703696e780d0ef12f · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-31681 · Vendor Advisory
• https://git.kernel.org/stable/c/36bf0d98e180a7c384c8d8a59b0d2d4b80e5eb16 · Patch
• https://cve.org/CVERecord?id=CVE-2026-31681 · Security Note
• https://git.kernel.org/stable/c/b67d638cbee9975c765feb45c126e96ed11ec802 · Note
• https://git.kernel.org/stable/c/8c5bf8f5b478f569191c4a7982de7cd5f5f73c1a · Note