Linux Kernel EUVD-2026-25648

The vulnerability resides in net/netfilter/xt_multiport.c within the Linux kernel's netfilter subsystem, which underpins iptables and nftables packet filtering. The xt_multiport module (loaded via 'iptables -m multiport') supports matching packets against multiple source or destination ports including port ranges encoded in the v1 format. In v1 encoding, a non-zero pflags[i] entry signals that ports[i] is the start of a range, and ports_match_v1() unconditionally treats the next array element ports[i+1] as the range end. The checkentry function validates protocol type, flag values, and port count but omits validation of the range encoding itself - it never confirms that each range-start entry has a successor within bounds, or that two consecutive entries are not both flagged as range starts. This constitutes an out-of-bounds read (analogous to CWE-125) when ports_match_v1() evaluates a packet against a malformed rule at runtime. CPE data identifies the affected product as cpe:2.3:a:linux:linux:* across all architectures, with the vulnerable code traceable to commit a89ecb6a2ef732d04058d87801e2b6bd7e5c7089 and the bug present as far back as Linux 2.6.17 when the xt_multiport v1 interface was introduced.