netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-31424
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-04-13 14:16:12 UTC
Updated2026-04-18 09:16:32 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP Weiming Shi says: xt_match and xt_target structs registered with NFPROTO_UNSPEC can be loaded by any protocol family through nft_compat. When such a match/target sets .hooks to restrict which hooks it may run on, the bitmask uses NF_INET_* constants. This is only correct for families whose hook layout matches NF_INET_*: IPv4, IPv6, INET, and bridge all share the same five hooks (PRE_ROUTING ... POST_ROUTING). ARP only has three hooks (IN=0, OUT=1, FORWARD=2) with different semantics. Because NF_ARP_OUT == 1 == NF_INET_LOCAL_IN, the .hooks validation silently passes for the wrong reasons, allowing matches to run on ARP chains where the hook assumptions (e.g. state->in being set on input hooks) do not hold. This leads to NULL pointer dereferences; xt_devgroup is one concrete example: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000044: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000220-0x0000000000000227] RIP: 0010:devgroup_mt+0xff/0x350 Call Trace: <TASK> nft_match_eval (net/netfilter/nft_compat.c:407) nft_do_chain (net/netfilter/nf_tables_core.c:285) nft_do_chain_arp (net/netfilter/nft_chain_filter.c:61) nf_hook_slow (net/netfilter/core.c:623) arp_xmit (net/ipv4/arp.c:666) </TASK> Kernel panic - not syncing: Fatal exception in interrupt Fix it by restricting arptables to NFPROTO_ARP extensions only. Note that arptables-legacy only supports: - arpt_CLASSIFY - arpt_mangle - arpt_MARK that provide explicit NFPROTO_ARP match/target declarations.

Risk And Classification

EPSS: 0.000240000 probability, percentile 0.066100000 (date 2026-04-18)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 9291747f118d6404e509747b85ff5f6dfec368d2 80e3c75f71c3ea1e62fcb032382de13e00a68f8b git Not specified
CNA Linux Linux affected 9291747f118d6404e509747b85ff5f6dfec368d2 d9a0af9e43416aa50c0595e15fa01365a1c72c49 git Not specified
CNA Linux Linux affected 9291747f118d6404e509747b85ff5f6dfec368d2 1cd6313c8644bfebbd813a05da9daa21b09dd68c git Not specified
CNA Linux Linux affected 9291747f118d6404e509747b85ff5f6dfec368d2 f00ac65c90ea475719e08d629e2e26c8b4e6999b git Not specified
CNA Linux Linux affected 9291747f118d6404e509747b85ff5f6dfec368d2 e7e1b6bcb389c8708003d40613a59ff2496f6b1f git Not specified
CNA Linux Linux affected 9291747f118d6404e509747b85ff5f6dfec368d2 dc3e27dd7d76e21106b8f9bbdc31f5da74a89014 git Not specified
CNA Linux Linux affected 9291747f118d6404e509747b85ff5f6dfec368d2 3e79374b03bf9a2f282f0eb1d0ac3776f7e0f28a git Not specified
CNA Linux Linux affected 9291747f118d6404e509747b85ff5f6dfec368d2 3d5d488f11776738deab9da336038add95d342d1 git Not specified
CNA Linux Linux affected 2.6.39 Not specified
CNA Linux Linux unaffected 2.6.39 semver Not specified
CNA Linux Linux unaffected 5.10.253 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.203 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.168 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.134 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.81 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.22 6.18.* semver Not specified
CNA Linux Linux unaffected 6.19.12 6.19.* semver Not specified
CNA Linux Linux unaffected 7.0 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/dc3e27dd7d76e21106b8f9bbdc31f5da74a89014 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3d5d488f11776738deab9da336038add95d342d1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3e79374b03bf9a2f282f0eb1d0ac3776f7e0f28a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d9a0af9e43416aa50c0595e15fa01365a1c72c49 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e7e1b6bcb389c8708003d40613a59ff2496f6b1f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f00ac65c90ea475719e08d629e2e26c8b4e6999b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/80e3c75f71c3ea1e62fcb032382de13e00a68f8b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/1cd6313c8644bfebbd813a05da9daa21b09dd68c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report