CVE-2026-31418

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: ipset: drop logically empty buckets in mtype_del<br /> <br /> mtype_del() counts empty slots below n-&gt;pos in k, but it only drops the<br /> bucket when both n-&gt;pos and k are zero. This misses buckets whose live<br /> entries have all been removed while n-&gt;pos still points past deleted slots.<br /> <br /> Treat a bucket as empty when all positions below n-&gt;pos are unused and<br /> release it directly instead of shrinking it further.