Vulnerability in c (CVE-2026-43114, CVSS 9.4)

Summary

vulnerability in c (CVE-2026-43114). Confidential information can be exposed externally.

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

New test case fails unexpectedly when avx2 matching functions are used.

The test first loads a ranomly generated pipapo set
with 'ipv4 . port' key, i.e. nft -f foo.

This works. Then, it reloads the set after a flush:
(echo flush set t s; cat foo) | nft -f -

This is expected to work, because its the same set after all and it was
already loaded once.

But with avx2, this fails: nft reports a clashing element.

The reported clash is of following form:

We successfully re-inserted
  a . b
  c . d

Then we try to insert a . d

avx2 finds the already existing a . d, which (due to 'flush set') is marked
as invalid in the new generation. It skips the element and moves to next.

Due to incorrect masking, the skip-step finds the next matching
element only considering the first field,

i.e. we return the already reinserted "a . b", even though the
last field is different and the entry should not have been matched.

No such error is reported for the generic c implementation (no avx2) or when
the last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback.

Bisection points to
7711f4bb4b36 ("netfilter: nft_set_pipapo: fix range overlap detection")
but that fix merely uncovers this bug.

Before this commit, the wrong element is returned, but erronously
reported as a full, identical duplicate.

The root-cause is too early re…

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

There is a security issue noted in the Linux kernel associated with netfilter. The vulnerability occurs because entries are not correctly processed under certain conditions, which can be exploited by attackers to gain unauthorized access. This poses a threat to the safety of a company's data. It is essential to update the kernel promptly, and IT departments should verify and apply updates quickly.

The vulnerability occurs in the Linux kernel's netfilter module, specifically within the avx2 matching function. It improperly processes expired entries by considering only the first field, leading to incorrect entry matches. An attacker can exploit this flaw to unauthorizedly manipulate data over the network. The issue can be resolved by updating the kernel to the latest version, where the patch is applied. Limiting the use of avx2 in kernel settings could also be considered. The discoverer is not clearly documented, but a commit by Florian Westphal addresses the issue. The CVSS score is quite high at 9.4, with potential for network attacks without authentication.

❓ What is the problem

Linuxカーネル内のnetfilterモジュールにおけるavx2マッチング機能の脆弱性

📍 Affected scope

Linuxカーネルのnetfilter：nft_set_pipapo_avx2内

🔥 Severity

ネットワーク経由での攻撃が可能で、認証不要。機密性と整合性に重大な影響。CVSSスコア9.4

🔧 How to fix

Linuxカーネルを最新の対応バージョンに更新する

🛡️ Workaround

avx2使用を制限する設定を考慮

🔍 Detection

特定できず

Related past incidents Similar incidents extracted from past CVEs

CVE-2021-22555

Linuxカーネルの古いバージョンにおいて、類似のネットワーク関連の脆弱性

CVE-2021-24086

AVX2命令を含む特定のカーネルコンポーネントに一連の脆弱性が発生した事例

CVE-2020-10711

Linuxカーネルのネットワークプロトコル処理に関するかつてのエラーハンドリング問題

If this happens at your company Expected impact per business scenario

📌 ECサイトのバックエンドサーバーに適用される場合

バックエンドサーバーのネットワークフィルタによる不正なトラフィックの許可により、データ流出や改ざんが発生する可能性がある。

📌 社内システムのファイアウォールに適用される場合

ファイアウォールの設定ミスが悪用され、内外部からの不正アクセスが相次ぎ、機密情報が流出する可能性がある。

📌 ネットワーク管理デバイスに適用される場合

ネットワーク管理デバイスの制御が奪われ、広範囲のネットワークダウンを引き起こす可能性がある。

Recommended action

Linuxカーネルのセキュリティ更新を迅速に適用し、影響を受けるネットワーク機器やサーバーの設定を見直す

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'c' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で c を grep し、稼働しているサービス・バージョンを把握する。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Fix status by distribution

Fixed packages published by each distribution for this CVE

BellSoft Alpaquita BELL-CVE-2026-43114 linux-lts Fixed in: 6.1.175-r0
Debian DEBIAN-CVE-2026-43114 linux
Ubuntu UBUNTU-CVE-2026-43114 linux

Vulnerability in c (CVE-2026-43114)