Skip to main content

Linux Kernel netfilter EUVDEUVD-2026-27637

| CVE-2026-43114 CRITICAL
Use of Incorrect Operator (CWE-480)
2026-05-06 Linux GHSA-6cwp-88hv-x237
Information Disclosure Linux
Critical
Disputed · 9.4 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain administrative access
  2. Delivery
    Identify pipapo set with composite keys
  3. Exploit
    Execute set flush operation
  4. Execution
    Attempt element reinsert
  5. Persist
    Trigger AVX2 partial-match bug
  6. Impact
    Cause rule deployment failure

Vulnerability Assessment

Weakness
CWE
CWE-480
ASVS 5.0
V15 - Secure Coding and Architecture Use of incorrect operator
Exploitation Conditions

Exploitation requires Linux kernel with AVX2 instruction support enabled (Intel Haswell/2013+ or AMD Excavator/2015+ CPUs with CONFIG_AS_AVX2=y kernel build option), active use of nftables with pipapo set type, composite key definitions in affected sets (e.g., 'type ipv4_addr . inet_service'), and administrative execution of set flush followed by element reinsert operations. The bug triggers during set reload workflows - not through normal packet filtering operations. AVX2 code path must be selected by kernel (automatic on supported hardware); generic C implementation and AVX2 slow-path fallback are unaffected. Attack surface is limited to local administrators with CAP_NET_ADMIN capability or root access to manipulate nftables rulesets. Network-based remote exploitation is not possible despite CVSS AV:N rating - the vulnerability affects control plane (rule management) not data plane (packet processing). Systems not using nftables, using non-composite-key sets, or running on non-AVX2 hardware are not affected.
Impact

Despite the critical CVSS 9.4 score suggesting network-accessible remote exploitation with high confidentiality and integrity impact, the actual risk profile is significantly lower. The vulnerability description reveals this affects firewall rule management operations (set flush/reload in nftables), not packet filtering itself - an attacker cannot directly trigger the bug through network traffic. The CVSS vector (AV:N/AC:L/PR:N/UI:N) appears misaligned with the technical reality: exploitation requires administrative access to manipulate nftables rulesets, not unauthenticated network access. The EPSS score of 0.02% (5th percentile) and absence from CISA KEV confirm negligible observed exploitation. No public exploit identified at time of analysis. Real-world risk is primarily operational: administrators on AVX2-capable systems may encounter spurious errors when reloading firewall rules with composite-key sets, potentially causing rule deployment failures. The High/High/Low impact ratings likely reflect worst-case theoretical scenarios rather than demonstrated exploitability. Priority should be moderate for production firewall systems using nftables with pipapo sets on AVX2 hardware (Intel Haswell/2013 or newer, AMD Excavator/2015 or newer), low for systems without these specific conditions.
Exploit ScenarioDerived

A system administrator managing an nftables firewall on an AVX2-capable Linux server uses pipapo sets with composite keys (e.g., tracking 'source_ip . destination_port' pairs for rate limiting). During routine firewall maintenance, the administrator flushes an existing set and attempts to reload the same rule definitions. The AVX2 lookup code incorrectly matches elements from the flushed (expired) generation due to partial field comparison, causing nftables to reject valid elements as duplicates. This results in incomplete firewall rule deployment, potentially leaving intended traffic restrictions unenforced or blocking legitimate traffic. No public exploit identified at time of analysis, and exploitation requires local administrative access to modify nftables configuration, not network-based remote access.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 08, 2026

A logic error in Linux kernel netfilter's AVX2-accelerated nft_set_pipapo matching allows incorrect element matching when flushing and reloading sets with composite keys (e.g., 'ipv4 . port'). The AVX2 code path prematurely returns non-matching entries during multi-field lookups, causing false collision reports when reinserting elements after a set flush. This affects netfilter firewall rule processing on systems with AVX2 CPU support. With CVSS 9.4 (AV:N/AC:L/PR:N/UI:N), the vector suggests critical network-accessible impact, though the description indicates this is a firewall rule management bug rather than a direct remote exploitation path. EPSS score of 0.02% (5th percentile) and no KEV listing suggest low real-world exploitation likelihood. Patches available across stable kernel branches 6.6.136, 6.12.83, 6.18.24, 6.19.14, and 7.0.

RemediationAI

Apply vendor-released kernel patches immediately for affected stable branches: upgrade to Linux 6.6.136+ (for 6.6.x series), 6.12.83+ (6.12.x), 6.18.24+ (6.18.x), 6.19.14+ (6.19.x), or mainline 7.0+. Patches available at https://git.kernel.org/stable/ with specific commits fa4f1f52528c (6.6), 3d53f9aafd46 (6.12), 07de44424bb7 (6.18), 0abbc43f71d9 (6.19), and d3c0037ffe12 (mainline). For systems where immediate patching is not feasible, compensating controls include: disable AVX2 support in kernel build (recompile with CONFIG_AS_AVX2=n) - eliminates performance optimization but prevents buggy code path; avoid nftables pipapo set type for composite keys, use alternative set implementations like hash or rbtree for 'ipv4 . port' mappings - trades lookup performance for correctness; avoid flush-and-reload workflows for nftables sets with composite keys, use atomic ruleset replacement instead. Note that disabling AVX2 impacts performance across multiple kernel subsystems beyond netfilter. See official advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-43114 for additional vendor guidance.

Affected VersionsENISA

Linux patch: 6.18.24
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <3d53f9aafd469ae1ea27051e00f5b96ca1b55d52
Linux patch: 6.19.14
Linux patch: 6.12.83
Linux patch: 6.6.136
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <d3c0037ffe1273fa1961e779ff6906234d6cf53c
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <fa4f1f52528c73989d820f32bfca06bec5afeece
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <07de44424bb7f17ef9357e8535df96d9e97c40cb
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <0abbc43f71d99baadeeba6fa3fe1c80b676f57ed
Linux patch: 7.0

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the Linux kernel's netfilter subsystem, specifically in the nft_set_pipapo AVX2-optimized lookup functions used for efficient set matching in nftables. Pipapo is a specialized set implementation for fast prefix/range matching using bitmaps. The AVX2 code paths (using Intel Advanced Vector Extensions 2 SIMD instructions) contain an early-return bug when processing multi-field composite keys. During element lookup, when matching the last field of a composite key (e.g., the port in 'ipv4_addr . port'), the AVX2 function fails to consume all input data, leaving stale bits in the match bitmap. This causes the function to return elements that match only on the first field while ignoring mismatches in subsequent fields. The bug becomes observable when flushing a set (marking existing entries invalid for the new generation) and reloading identical elements: expired entries from the previous generation are incorrectly matched due to partial field comparison, triggering false duplicate-element errors. The generic C implementation and AVX2 slow-path fallback are unaffected. Commit 7711f4bb4b36 exposed this latent bug by improving range overlap detection.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY 9.4 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
SUSE CRITICAL
Red Hat 5.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

3
CVSS changed
May 08, 2026 - 13:22 NVD
9.4 (CRITICAL)
Patch available
May 06, 2026 - 11:31 EUVD
CVE Published
May 06, 2026 - 07:40 nvd
CRITICAL 9.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

New test case fails unexpectedly when avx2 matching functions are used.

The test first loads a ranomly generated pipapo set with 'ipv4 . port' key, i.e. nft -f foo.

This works. Then, it reloads the set after a flush: (echo flush set t s; cat foo) | nft -f -

This is expected to work, because its the same set after all and it was already loaded once.

But with avx2, this fails: nft reports a clashing element.

The reported clash is of following form:

We successfully re-inserted a . b c . d

Then we try to insert a . d

avx2 finds the already existing a . d, which (due to 'flush set') is marked as invalid in the new generation. It skips the element and moves to next.

Due to incorrect masking, the skip-step finds the next matching element *only considering the first field*,

i.e. we return the already reinserted "a . b", even though the last field is different and the entry should not have been matched.

No such error is reported for the generic c implementation (no avx2) or when the last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback.

Bisection points to 7711f4bb4b36 ("netfilter: nft_set_pipapo: fix range overlap detection") but that fix merely uncovers this bug.

Before this commit, the wrong element is returned, but erronously reported as a full, identical duplicate.

The root-cause is too early return in the avx2 match functions. When we process the last field, we should continue to process data until the entire input size has been consumed to make sure no stale bits remain in the map.

Executive ViewAI

Why It Matters

A critical logic error in Linux kernel netfilter's AVX2-accelerated packet filtering allows incorrect firewall rule matching on composite keys (e.g., IP address and port combinations), potentially causing security rules to fail silently when administrators reload firewall configurations. This affects Linux systems with AVX2 CPU support and could enable traffic to bypass intended access controls if firewall rules are flushed and reloaded during operations.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible, avoid flushing and reloading netfilter sets with composite keys during operations; restart firewall services cleanly rather than dynamic set updates; monitor firewall logs for rule violations that may indicate silent bypass; disable AVX2 kernel optimization via GRUB parameter 'noavx2' as temporary mitigation (performance impact expected).

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Threat Intel
1
1 source
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

57
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +47
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-480 – Use of Incorrect Operator

View all
CVE-2022-1947 MEDIUM POC
6.5
CVE-2026-15043 CRITICAL
9.8
CVE-2026-48497 HIGH
7.5
CVE-2026-4748 HIGH
7.5
CVE-2026-79643 HIGH
7.3
CVE-2026-44722 MEDIUM
6.2
CVE-2025-52985 MEDIUM
5.3
CVE-2026-83525 LOW

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-295-16
Sources: CISA (public domain)

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43114 ADVISORY https://ubuntu.com/security/notices/USN-8490-1 ADVISORY https://vuldb.com/vuln/361309 REF https://access.redhat.com/errata/RHSA-2026:59723 REF https://access.redhat.com/errata/RHSA-2026:62568 REF https://access.redhat.com/errata/RHSA-2026:62638 REF https://access.redhat.com/errata/RHSA-2026:62639 REF https://access.redhat.com/errata/RHSA-2026:62640 REF https://access.redhat.com/errata/RHSA-2026:62641 REF https://access.redhat.com/errata/RHSA-2026:62642 REF https://access.redhat.com/errata/RHSA-2026:63093 REF https://access.redhat.com/errata/RHSA-2026:64767 REF https://access.redhat.com/errata/RHSA-2026:65712 REF https://access.redhat.com/errata/RHSA-2026:66351 REF https://access.redhat.com/errata/RHSA-2026:66370 REF https://access.redhat.com/errata/RHSA-2026:66376 REF https://access.redhat.com/errata/RHSA-2026:67721 REF https://access.redhat.com/errata/RHSA-2026:67723 REF https://access.redhat.com/security/cve/CVE-2026-43114 REF https://bugzilla.redhat.com/show_bug.cgi?id=2466994 REF https://cert-portal.siemens.com/productcert/html/ssa-784472.html REF https://git.kernel.org/stable/c/07de44424bb7f17ef9357e8535df96d9e97c40cb REF https://git.kernel.org/stable/c/0abbc43f71d99baadeeba6fa3fe1c80b676f57ed REF https://git.kernel.org/stable/c/1c43f0dd8691ddf8884793b481ddc7511cf593c3 REF https://git.kernel.org/stable/c/3d53f9aafd469ae1ea27051e00f5b96ca1b55d52 REF https://git.kernel.org/stable/c/c7babe2f28b507e17f28e9f753b7caec72d4857f REF https://git.kernel.org/stable/c/d3c0037ffe1273fa1961e779ff6906234d6cf53c REF https://git.kernel.org/stable/c/f8c39983fc9c1a978c82e6f2df7bfba8a8561587 REF https://git.kernel.org/stable/c/fa4f1f52528c73989d820f32bfca06bec5afeece REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43114.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy