Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to crash the system. The issue exists in the Netfilter component, which handles network traffic filtering and firewall rules. By exploiting a mismatch in how different network protocols handle security checks, an attacker can trigger a system failure (kernel panic), leading to a complete service outage.
Technical details
A vulnerability in netfilter's x_tables allows xt_match and xt_target structs registered with NFPROTO_UNSPEC to be loaded by the ARP protocol family through nft_compat. Because the hook layouts for NF_INET_* and NFPROTO_ARP differ but share overlapping bitmask values (NF_ARP_OUT and NF_INET_LOCAL_IN both equal 1), validation checks incorrectly pass. This allows matches to execute on ARP chains where expected hook assumptions, such as the presence of input device state, are not met. This results in a NULL pointer dereference and subsequent kernel panic. The fix restricts arptables to only use explicit NFPROTO_ARP extensions.
Affected products
- Linux Linux kernel 2.6.39 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.168, 6.2 to 6.6.134, 6.7 to 6.12.81, 6.13 to 6.18.22, 6.19 to 6.19.12, 7.0-rc1 to 7.0-rc6
Timeline
- 2026-03-31: patched: Initial patch authored by Pablo Neira Ayuso
- 2026-04-13: advisory: CVE-2026-31424 published by kernel.org
References
- https://git.kernel.org/stable/c/1cd6313c8644bfebbd813a05da9daa21b09dd68c
- https://git.kernel.org/stable/c/3d5d488f11776738deab9da336038add95d342d1
- https://git.kernel.org/stable/c/3e79374b03bf9a2f282f0eb1d0ac3776f7e0f28a
- https://git.kernel.org/stable/c/80e3c75f71c3ea1e62fcb032382de13e00a68f8b
- https://git.kernel.org/stable/c/d9a0af9e43416aa50c0595e15fa01365a1c72c49
- https://git.kernel.org/stable/c/dc3e27dd7d76e21106b8f9bbdc31f5da74a89014
- https://git.kernel.org/stable/c/e7e1b6bcb389c8708003d40613a59ff2496f6b1f