CVE-2026-31424 netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
A null pointer dereference in the Linux kernel netfilter subsystem allows local attackers to cause a system crash via ARP packet processing.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31424?
CVE-2026-31424 is a medium-severity vulnerability in Linux kernel, published on 13 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
Weiming Shi says:
xt_match and xt_target structs registered with NFPROTO_UNSPEC can be loaded by any protocol family through nft_compat. When such a match/target sets .hooks to restrict which hooks it may run on, the bitmask uses NF_INET_* constants. This is only correct for families whose hook layout matches NF_INET_*: IPv4, IPv6, INET, and bridge all share the same five hooks (PRE_ROUTING ... POST_ROUTING).
ARP only has three hooks (IN=0, OUT=1, FORWARD=2) with different semantics. Because NF_ARP_OUT == 1 == NF_INET_LOCAL_IN, the .hooks validation silently passes for the wrong reasons, allowing matches to run on ARP chains where the hook assumptions (e.g. state->in being set on input hooks) do not hold. This leads to NULL pointer dereferences; xt_devgroup is one concrete example:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000044: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000220-0x0000000000000227] RIP: 0010:devgroup_mt+0xff/0x350 Call Trace: <TASK> nft_match_eval (net/netfilter/nft_compat.c:407) nft_do_chain (net/netfilter/nf_tables_core.c:285) nft_do_chain_arp (net/netfilter/nft_chain_filter.c:61) nf_hook_slow (net/netfilter/core.c:623) arp_xmit (net/ipv4/arp.c:666) </TASK> Kernel panic - not syncing: Fatal exception in interrupt
Fix it by restricting arptables to NFPROTO_ARP extensions only. Note that arptables-legacy only supports:
- arpt_CLASSIFY - arpt_mangle - arpt_MARK
that provide explicit NFPROTO_ARP match/target declarations.
Weakness: CWE-476
Which versions are affected by CVE-2026-31424?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31424?
Apply the vendor's patch.
Is CVE-2026-31424 being exploited?
There is no known exploitation of CVE-2026-31424 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-82697, BELL-CVE-2026-31424, DEBIAN-CVE-2026-31424, GHSA-9r6p-6xq4-mrq9, ROOT-OS-DEBIAN-11-CVE-2026-31424, ROOT-OS-DEBIAN-12-CVE-2026-31424 and 4 more.