Linux Kernel Vulnerability in Netfilter Affecting ipset Functionality

CVE-2026-31418

What is CVE-2026-31418?

A vulnerability in the Linux kernel's netfilter module affects the ipset functionality, specifically within the mtype_del() function. This issue arises when empty slots in the data structure are not appropriately counted and released. The function only deletes a bucket if both n->pos and k are zero, which can lead to improper memory management. This oversight can allow for potentially unwarranted memory retention, complicating resource usage and performance. Proper handling of empty buckets, when all positions below n->pos are unused, is recommended to enhance system stability and security.

References