CVE-2026-31681

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_multiport: validate range encoding in checkentry

ports_match_v1() treats any non-zero pflags entry as the start of a

port range and unconditionally consumes the next ports[] element as

the range end.

The checkentry path currently validates protocol, flags and count, but

it does not validate the range encoding itself. As a result, malformed

rules can mark the last slot as a range start or place two range starts

back to back, leaving ports_match_v1() to step past the last valid

ports[] element while interpreting the rule.

Reject malformed multiport v1 rules in checkentry by validating that

each range start has a following element and that the following element

is not itself marked as another range start.