CVE-2026-31424: In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: restrict xt_check_match/xt_che

A vulnerability in the Linux kernel's netfilter (the system that filters network packets) allowed matches and targets designed for general use to be incorrectly loaded into ARP (a protocol for finding IP addresses on local networks) chains, causing NULL pointer dereferences (crashes when code tries to access memory that doesn't exist) because ARP has different hook layouts than other protocols. The issue occurred because ARP's hooks have different meanings than IPv4/IPv6 hooks, but the validation code didn't catch this mismatch.