#VU125858 Improper control of a resource through its lifetime in Linux kernel - CVE-2026-31418
Published: April 14, 2026
Vulnerability identifier: #VU125858
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-31418
CWE-ID: CWE-664
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Linux kernel
Linux kernel
Software vendor:
Linux Foundation
Linux Foundation
Description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource management in mtype_del in the ipset netfilter subsystem when deleting entries from buckets containing only deleted slots below the current position. A local user can trigger bucket deletion handling with crafted set operations to cause a denial of service.
Remediation
Install security update from vendor's repository.
External links
- https://git.kernel.org/stable/c/68ca0eea0af02bed36c5e2c13e9fa1647c31a7d4
- https://git.kernel.org/stable/c/6cea34d7ec6829b62f521a37a287f670144a2233
- https://git.kernel.org/stable/c/9862ef9ab0a116c6dca98842aab7de13a252ae02
- https://git.kernel.org/stable/c/ad92ee87462f9a3061361d392e9dbfe2e5c1c9fb
- https://git.kernel.org/stable/c/b7eef00f08b92b0b9efe8ae0df6d0005e6199323
- https://git.kernel.org/stable/c/ceacaa76f221a6577aba945bb8873c2e640aeba4