CVE-2026-72252netfilter: nft_set_pipapo: don't leak bad clone into future transaction
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nft_pipapo_match can enter a bad state: - some fields can have their lookup tables resized while others did not - bits might have been toggled - scratch map can be undersized which also means m->bsize_max can be lower than what is required This means that the next insertion in the same batch can trigger out-of-bounds writes. Furthermore, a failure in the first can result in the bad clone to leak into the next transaction because the abort callback is never executed in this case (the upper layer saw an error and no attempt to allocate a transactional request was made). Record a state for the nft_pipapo_match structure: - NEW (pristine clone) - MOD (modified clone with good state) - ERR (potentially bogus content) Then make it so that deletes and insertions fail when the clone entered ERR state. In case the very first insert attempt results in an error, free the clone right away.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 3c4287f62044a90e73a561aa05fc46e62da173da builds before 0ab7b1802f63ca5b288ea59acb467830b83abd6b; from 3c4287f62044a90e73a561aa05fc46e62da173da before cc53703f48558896295f565cd4f5e956d21b7af4; from 3c4287f62044a90e73a561aa05fc46e62da173da before 047e813324eac2ac60cddfb58bcdbd0144eadb09; from 3c4287f62044a90e73a561aa05fc46e62da173da before 610e3b73efaec3dd81a95dcda2421ad7d9795bd0; 3c4287f62044a90e73a561aa05fc46e62da173da builds before 02b6b0e892aea582590671796fd6eff5b93ea93f; from 3c4287f62044a90e73a561aa05fc46e62da173da before e74f9680e1b64872a51cc7b5bda1edaaa08aa51f; from 3c4287f62044a90e73a561aa05fc46e62da173da before 47e65eff50691f0a5b79d325e28d83ec1da43bcf | CNA record |
References
- https://git.kernel.org/stable/c/0ab7b1802f63ca5b288ea59acb467830b83abd6b
- https://git.kernel.org/stable/c/cc53703f48558896295f565cd4f5e956d21b7af4
- https://git.kernel.org/stable/c/047e813324eac2ac60cddfb58bcdbd0144eadb09
- https://git.kernel.org/stable/c/610e3b73efaec3dd81a95dcda2421ad7d9795bd0
- https://git.kernel.org/stable/c/02b6b0e892aea582590671796fd6eff5b93ea93f
- https://git.kernel.org/stable/c/e74f9680e1b64872a51cc7b5bda1edaaa08aa51f
- https://git.kernel.org/stable/c/47e65eff50691f0a5b79d325e28d83ec1da43bcf
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.