CVE-2026-31424

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the x_tables and arptables components. This vulnerability arises when xt_match and xt_target extensions, registered for unspecified protocol families, are incorrectly processed by the Address Resolution Protocol (ARP) subsystem. An attacker could exploit this by crafting network packets that trigger a mismatch in hook validation, leading to a null pointer dereference and ultimately a kernel panic, resulting in a Denial of Service (DoS) for the affected system.

Incorrect extension registration for ARP chains is a correctness bug in the netfilter compatibility path. Exploitation for a panic requires a privileged user to install matching nftables/arptables rules that pull in the affected xt_* pieces on ARP traffic. The fix limits arptables to extensions explicitly declared for NFPROTO_ARP.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.