Linux Kernel Vulnerability in Netfilter's X_tables Impacting ARP Protocol

CVE-2026-31424

What is CVE-2026-31424?

A vulnerability exists in the Linux kernel's netfilter component, specifically affecting the x_tables subsystem when dealing with the ARP protocol. The flaw is due to insufficient restrictions on xt_match and xt_target structs registered with NFPROTO_UNSPEC, which allows loading by any protocol family. This misconfiguration can result in incorrect hook validation for ARP chains, leading to possible NULL pointer dereferences and kernel panics during operation. To mitigate this risk, arptables must be confined strictly to NFPROTO_ARP extensions, ensuring that only valid match and target declarations are utilized.

References