Linux Kernel EUVD-2026-59151

The vulnerability resides in nft_set_pipapo, the 'Piece PAcket POlicy' multi-dimensional packet classifier used by the Linux kernel's nftables subsystem (netfilter). The pipapo algorithm stores lookup tables in nft_pipapo_match structures that are cloned at the start of each batch transaction to support transactional semantics. When a memory allocation fails mid-clone, fields such as the lookup table arrays, the scratch map, and bsize_max can be left in a partially updated state - some resized, others not - producing a structurally invalid clone. Critically, the abort callback that would normally discard this clone is never invoked when the upper layer observes an error before any transactional request is attempted, allowing the corrupt nft_pipapo_match to survive into the next transaction. The fix introduces a tristate status field (NEW, MOD, ERR) on the clone and enforces that insert and delete operations fail fast when ERR is set, with the first-insert-error path immediately freeing the clone. The root cause aligns with improper error-path cleanup in kernel memory management (no formal CWE assigned in this entry). Affected kernel versions begin at 5.6, which introduced the pipapo set type at commit 3c4287f62044a90e73a561aa05fc46e62da173da.