netfilter: nft_set_pipapo_avx2: don’t return non-matching entry on expiry_CVE-2026-43114

9.4 / 10

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

New test case fails unexpectedly when avx2 matching functions are used.

The test first loads a ranomly generated pipapo set
with 'ipv4 . port' key, i.e. nft -f foo.

This works. Then, it reloads the set after a flush:
(echo flush set t s; cat foo) | nft -f -

This is expected to work, because its the same set after all and it was
already loaded once.

But with avx2, this fails: nft reports a clashing element.

The reported clash is of following form:

We successfully re-inserted
a . b
c . d

Then we try to insert a . d

avx2 finds the already existing a . d, which (due to 'flush set') is marked
as invalid in the new generation. It skips the element and moves to next.

Due to incorrect masking, the skip-step finds the next matching
element *only considering the first field*,

i.e. we return the already reinserted "a . b", even though the
last field is different and the entry should not have been matched.

No such error is reported for the generic c implementation (no avx2) or when
the last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback.

Bisection points to
7711f4bb4b36 ("netfilter: nft_set_pipapo: fix range overlap detection")
but that fix merely uncovers this bug.

Before this commit, the wrong element is returned, but erronously
reported as a full, identical duplicate.

The root-cause is too early return in the avx2 match functions.
When we process the last field, we should continue to process data
until the entire input size has been consumed to make sure no stale
bits remain in the map.

AI Analysis

A vulnerability in the Linux kernel's netfilter module allows for incorrect matching of elements due to premature return in the avx2 match functions, potentially leading to security issues.

Basic Information

ID CVE-2026-43114

Source Linux

Published May 6, 2026 at 07:40

Modified May 8, 2026 at 12:40

Affected Product

Vendor Linux

Product Linux

Version 7400b063969bdca4a06cd97f1294d765c8eecbe1

Affected Versions Linux Linux 7400b063969bdca4a06cd97f1294d765c8eecbe1
Linux Linux 7400b063969bdca4a06cd97f1294d765c8eecbe1
Linux Linux 7400b063969bdca4a06cd97f1294d765c8eecbe1
Linux Linux 7400b063969bdca4a06cd97f1294d765c8eecbe1
Linux Linux 7400b063969bdca4a06cd97f1294d765c8eecbe1
Linux Linux 5.7

AI Assessment

AI Score 9.4 / 10

AI Severity Critical

Vendor Linux Foundation

Product Linux Kernel

Version 5.7, 7400b063969bdca4a06cd97f1294d765c8eecbe1

References

{
    "lastseen": "",
    "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry\n\nNew test case fails unexpectedly when avx2 matching functions are used.\n\nThe test first loads a ranomly generated pipapo set\nwith 'ipv4 . port' key, i.e.  nft -f foo.\n\nThis works.  Then, it reloads the set after a flush:\n(echo flush set t s; cat foo) | nft -f -\n\nThis is expected to work, because its the same set after all and it was\nalready loaded once.\n\nBut with avx2, this fails: nft reports a clashing element.\n\nThe reported clash is of following form:\n\n    We successfully re-inserted\n      a . b\n      c . d\n\nThen we try to insert a . d\n\navx2 finds the already existing a . d, which (due to 'flush set') is marked\nas invalid in the new generation.  It skips the element and moves to next.\n\nDue to incorrect masking, the skip-step finds the next matching\nelement *only considering the first field*,\n\ni.e. we return the already reinserted \"a . b\", even though the\nlast field is different and the entry should not have been matched.\n\nNo such error is reported for the generic c implementation (no avx2) or when\nthe last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback.\n\nBisection points to\n7711f4bb4b36 (\"netfilter: nft_set_pipapo: fix range overlap detection\")\nbut that fix merely uncovers this bug.\n\nBefore this commit, the wrong element is returned, but erronously\nreported as a full, identical duplicate.\n\nThe root-cause is too early return in the avx2 match functions.\nWhen we process the last field, we should continue to process data\nuntil the entire input size has been consumed to make sure no stale\nbits remain in the map.",
    "published": "2026-05-06T07:40:39.877Z",
    "modified": "2026-05-08T12:40:39.582Z",
    "type": "cve",
    "title": "netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry",
    "source": "Linux",
    "references": "https://git.kernel.org/stable/c/fa4f1f52528c73989d820f32bfca06bec5afeece\nhttps://git.kernel.org/stable/c/3d53f9aafd469ae1ea27051e00f5b96ca1b55d52\nhttps://git.kernel.org/stable/c/07de44424bb7f17ef9357e8535df96d9e97c40cb\nhttps://git.kernel.org/stable/c/0abbc43f71d99baadeeba6fa3fe1c80b676f57ed\nhttps://git.kernel.org/stable/c/d3c0037ffe1273fa1961e779ff6906234d6cf53c",
    "id": "CVE-2026-43114",
    "bulletinFamily": "",
    "cwe": null,
    "cvelist": null,
    "sourceData": "Linux Linux 7400b063969bdca4a06cd97f1294d765c8eecbe1\nLinux Linux 7400b063969bdca4a06cd97f1294d765c8eecbe1\nLinux Linux 7400b063969bdca4a06cd97f1294d765c8eecbe1\nLinux Linux 7400b063969bdca4a06cd97f1294d765c8eecbe1\nLinux Linux 7400b063969bdca4a06cd97f1294d765c8eecbe1\nLinux Linux 5.7",
    "sourceHref": "",
    "cvss": {
        "score": 9.4,
        "severity": "CRITICAL",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Linux",
    "version": "7400b063969bdca4a06cd97f1294d765c8eecbe1",
    "vendor": "Linux",
    "ai_description": "A vulnerability in the Linux kernel's netfilter module allows for incorrect matching of elements due to premature return in the avx2 match functions, potentially leading to security issues.",
    "ai_severity": "Critical",
    "ai_vendor": "Linux Foundation",
    "ai_product": "Linux Kernel",
    "ai_version": "5.7, 7400b063969bdca4a06cd97f1294d765c8eecbe1",
    "ai_score": 9.4
}