CVE-2026-31418: Linux Kernel Netfilter IPset DoS Flaw

CVE-2026-31418 Overview

A memory leak vulnerability has been identified in the Linux kernel's netfilter ipset subsystem. The mtype_del() function improperly handles bucket cleanup during element deletion operations, failing to release logically empty buckets when live entries have been removed but the position pointer (n->pos) still references past deleted slots.

Critical Impact

This vulnerability can lead to kernel memory exhaustion through accumulated unreleased hash buckets, potentially causing denial of service conditions on affected Linux systems running netfilter with ipset configurations.

Affected Products

• Linux Kernel (netfilter ipset subsystem)
• Systems utilizing netfilter ipset hash tables

Discovery Timeline

• April 13, 2026 - CVE-2026-31418 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31418

Vulnerability Analysis

The vulnerability exists within the mtype_del() function in the Linux kernel's netfilter ipset implementation. This function is responsible for removing entries from ipset hash tables and managing the associated memory structures. The core issue lies in the logic used to determine when a hash bucket should be released.

The function counts empty slots below n->pos in a variable k, but the bucket cleanup logic only triggers when both n->pos and k are zero. This conditional check fails to account for a critical edge case: buckets where all live entries have been removed but n->pos still points past previously deleted slots. In this scenario, the bucket remains allocated despite being logically empty, as the position pointer retains its value from prior operations.

Root Cause

The root cause stems from an incomplete condition check in the bucket release logic within mtype_del(). The function incorrectly assumes that a non-zero n->pos value indicates active entries exist in the bucket. However, when entries are deleted, the position pointer is not always decremented to reflect the actual state of the bucket's contents. This creates a discrepancy between the bucket's logical state (empty) and its tracked state (appearing to have content due to the stale position pointer).

The fix treats a bucket as empty when all positions below n->pos are unused and releases it directly instead of attempting further shrinking operations, preventing the memory leak condition.

Attack Vector

An attacker with the ability to manipulate ipset entries (typically requiring local access or network service access that interacts with netfilter rules) could exploit this vulnerability by repeatedly adding and removing entries from ipset hash tables. Each deletion cycle that triggers the vulnerable code path would leave unreleased bucket memory, gradually consuming kernel memory resources.

Over time, this memory exhaustion could degrade system performance and potentially lead to denial of service conditions. The attack is particularly effective in environments where ipsets are dynamically modified, such as systems implementing blocklists or rate limiting through netfilter.

The vulnerability mechanism involves the bucket position tracking in the ipset hash table implementation. When the mtype_del() function processes element deletions, it maintains a position counter that can become inconsistent with the actual bucket state after multiple operations. The kernel commits referenced in the external references section provide the complete fix implementation. See Kernel Git Commit for technical details.

Detection Methods for CVE-2026-31418

Indicators of Compromise

• Gradual increase in kernel memory consumption over time on systems using netfilter ipset
• Unexplained growth in slab memory allocations related to hash table structures
• System performance degradation correlating with ipset modification operations

Detection Strategies

• Monitor kernel memory metrics for abnormal growth patterns in slab allocations
• Implement memory threshold alerting for systems running netfilter with dynamic ipset configurations
• Review system logs for out-of-memory (OOM) events that may indicate exploitation

Monitoring Recommendations

• Deploy kernel memory monitoring tools to track slab allocations over extended periods
• Establish baseline memory profiles for systems with active ipset usage
• Configure alerts for memory consumption exceeding expected thresholds on firewall and gateway systems

How to Mitigate CVE-2026-31418

Immediate Actions Required

• Update the Linux kernel to a patched version containing the netfilter ipset fix
• Review systems with dynamic ipset configurations for potential memory exhaustion symptoms
• Schedule maintenance windows for kernel updates on production firewall systems

Patch Information

Multiple kernel commits address this vulnerability across different stable kernel branches. The fix modifies the mtype_del() function to properly treat buckets as empty when all positions below n->pos are unused, releasing the bucket directly rather than attempting to shrink it.

Relevant kernel patches are available from the following sources:

• Kernel Git Commit 68ca0eea
• Kernel Git Commit 6cea34d7
• Kernel Git Commit 9862ef9a
• Kernel Git Commit ad92ee87
• Kernel Git Commit b7eef00f
• Kernel Git Commit ceacaa76

Workarounds

• Minimize dynamic ipset modifications on production systems until patching is complete
• Implement periodic system reboots during maintenance windows to reclaim leaked memory
• Consider using alternative firewall rule implementations that do not rely on ipset hash tables for critical systems pending kernel updates

# Check current kernel version for patching status
uname -r

# Monitor kernel memory for potential leak indicators
cat /proc/meminfo | grep -E "(Slab|SUnreclaim)"

# List active ipsets to identify affected configurations
ipset list -n