Executive brief
A vulnerability exists in the Linux kernel's networking subsystem, specifically within the Netfilter framework used for firewalls and traffic filtering. The issue affects how the system handles complex rule sets (pipapo) when using high-performance AVX2 processor instructions. An attacker could potentially bypass security rules or cause data to be incorrectly processed, leading to unauthorized access or service disruptions.
Technical details
A logic error in the AVX2-optimized matching functions of the nft_set_pipapo component in the Linux kernel leads to incorrect range overlap detection. The root cause is an early return in the AVX2 match functions; when processing the last field of a concatenated key, the function may return a match based only on the first field due to incorrect masking and stale bits remaining in the map. This occurs specifically when elements are marked as invalid in a new generation (e.g., after a 'flush set' command). Attackers can exploit this to bypass firewall rules or cause incorrect element clashing. Patches have been released for multiple stable kernel branches including 6.6.y, 6.12.y, and 6.19.y.
Affected products
- Linux Linux Kernel 5.7 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc5
Timeline
- 2026-05-06: disclosed
- 2026-05-06: advisory
- 2026-04-22: patched
References
- https://git.kernel.org/stable/c/07de44424bb7f17ef9357e8535df96d9e97c40cb
- https://git.kernel.org/stable/c/0abbc43f71d99baadeeba6fa3fe1c80b676f57ed
- https://git.kernel.org/stable/c/1c43f0dd8691ddf8884793b481ddc7511cf593c3
- https://git.kernel.org/stable/c/3d53f9aafd469ae1ea27051e00f5b96ca1b55d52
- https://git.kernel.org/stable/c/c7babe2f28b507e17f28e9f753b7caec72d4857f
- https://git.kernel.org/stable/c/d3c0037ffe1273fa1961e779ff6906234d6cf53c
- https://git.kernel.org/stable/c/f8c39983fc9c1a978c82e6f2df7bfba8a8561587