CVE-2025-38120
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
In the Linux kernel netfilter nf_set_pipapo_avx2 module, an initial map fill bug: if the first field doesn't cover the entire start map, remaining bits are not zeroed, leaking those bits into the next match round. The fix for the C implementation was incomplete.
Risk Assessment
The bug can lead to incorrect packet filtering rule matching, potentially allowing an attacker to bypass rules and access unauthorized resources.
Recommendation
Apply the Linux kernel patch that correctly zeroes the remaining bits of the start map in the AVX2 implementation of the nf_set_pipapo module.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_set_pipapo_avx2: fix initial map fill If the first field doesn't cover the entire start map, then we must zero out the remainder, else we leak those bits into the next match round map. The early fix was incomplete and did only fix up the generic C implementation. A followup patch adds a test case to nft_concat_range.sh.