Medium 5.5Published Apr 13, 2026

CVE-2026-31418netfilter: ipset: drop logically empty buckets in mtype_del

Updated under an hour ago (Oct 27, 2026, 8:23 AM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: drop logically empty buckets in mtype_del mtype_del() counts empty slots below n->pos in k, but it only drops the bucket when both n->pos and k are zero. This misses buckets whose live entries have all been removed while n->pos still points past deleted slots. Treat a bucket as empty when all positions below n->pos are unused and release it directly instead of shrinking it further.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 8af1c6fbd9239877998c7f5a591cb2c88d41fb66 before c098ff857e7ca923539164af5b3c2fe3e8f8afaf; from 8af1c6fbd9239877998c7f5a591cb2c88d41fb66 before 58f3a14826d4e6b0d5421f1a64be280b48601ea2; from 8af1c6fbd9239877998c7f5a591cb2c88d41fb66 before ad92ee87462f9a3061361d392e9dbfe2e5c1c9fb; 8af1c6fbd9239877998c7f5a591cb2c88d41fb66 builds before 6cea34d7ec6829b62f521a37a287f670144a2233; from 8af1c6fbd9239877998c7f5a591cb2c88d41fb66 before b7eef00f08b92b0b9efe8ae0df6d0005e6199323; from 8af1c6fbd9239877998c7f5a591cb2c88d41fb66 before 68ca0eea0af02bed36c5e2c13e9fa1647c31a7d4; from 8af1c6fbd9239877998c7f5a591cb2c88d41fb66 before ceacaa76f221a6577aba945bb8873c2e640aeba4; from 8af1c6fbd9239877998c7f5a591cb2c88d41fb66 before 9862ef9ab0a116c6dca98842aab7de13a252ae02; and 4 more ranges	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.4.24 before 5.5; from 5.5.8 before 5.6; from 5.6.1 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.168; from 6.2 before 6.6.134; from 6.7 before 6.12.81; from 6.13 before 6.18.22; and 12 more ranges	NVD

References

References

https://git.kernel.org/stable/c/c098ff857e7ca923539164af5b3c2fe3e8f8afaf	patch
https://git.kernel.org/stable/c/58f3a14826d4e6b0d5421f1a64be280b48601ea2	patch
https://git.kernel.org/stable/c/ad92ee87462f9a3061361d392e9dbfe2e5c1c9fb	patch
https://git.kernel.org/stable/c/6cea34d7ec6829b62f521a37a287f670144a2233	patch
https://git.kernel.org/stable/c/b7eef00f08b92b0b9efe8ae0df6d0005e6199323	patch
https://git.kernel.org/stable/c/68ca0eea0af02bed36c5e2c13e9fa1647c31a7d4	patch
https://git.kernel.org/stable/c/ceacaa76f221a6577aba945bb8873c2e640aeba4	patch
https://git.kernel.org/stable/c/9862ef9ab0a116c6dca98842aab7de13a252ae02	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.