In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: reject mismatching sum of fieldlen with set key length
The field length description provides the length of each separated key field in the concatenation, each field gets rounded up to 32-bits to calculate the pipapo rule width from pipapo_init(). The set key length provides the total size of the key aligned to 32-bits.
Register-based arithmetics still allows for combining mismatching set key length and field length description, eg. set key length 10 and field description [ 5, 4 ] leading to pipapo width of 12.
[
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"187245259883225429983034000993831642975",
"311703199331790373030499827695858946467",
"336176781971360906019725899395634999150",
"61200429283572909898597805020862979858",
"196360888918844303002642424536278224998",
"222593137439896764169371426866097620572",
"240832801201238492914297244471740652449",
"86862991049458059478327745378146058074",
"70953920739078041769421010377430045259",
"11821021757963023233348608933014079716",
"93824480709851279815117307805325495379"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b467c8feac759f4c5c86d708beca2aa2b29584f",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2025-21826-057909ba"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 565.0,
"function_hash": "111006780507749980892451018149909879321"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ac254343d3cf228ae0738b2615fedf85d000752",
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nft_set_desc_concat"
},
"id": "CVE-2025-21826-220a6b0d"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 565.0,
"function_hash": "111006780507749980892451018149909879321"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49b7182b97bafbd5645414aff054b4a65d05823d",
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nft_set_desc_concat"
},
"id": "CVE-2025-21826-2d40875a"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 565.0,
"function_hash": "111006780507749980892451018149909879321"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b9335a8000fb70742f7db10af314104b6ace220",
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nft_set_desc_concat"
},
"id": "CVE-2025-21826-38848c01"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"187245259883225429983034000993831642975",
"311703199331790373030499827695858946467",
"336176781971360906019725899395634999150",
"61200429283572909898597805020862979858",
"196360888918844303002642424536278224998",
"222593137439896764169371426866097620572",
"240832801201238492914297244471740652449",
"86862991049458059478327745378146058074",
"70953920739078041769421010377430045259",
"11821021757963023233348608933014079716",
"93824480709851279815117307805325495379"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ac254343d3cf228ae0738b2615fedf85d000752",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2025-21826-54e4b0ec"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"187245259883225429983034000993831642975",
"311703199331790373030499827695858946467",
"336176781971360906019725899395634999150",
"61200429283572909898597805020862979858",
"196360888918844303002642424536278224998",
"222593137439896764169371426866097620572",
"240832801201238492914297244471740652449",
"86862991049458059478327745378146058074",
"70953920739078041769421010377430045259",
"11821021757963023233348608933014079716",
"93824480709851279815117307805325495379"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49b7182b97bafbd5645414aff054b4a65d05823d",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2025-21826-98326b53"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 565.0,
"function_hash": "111006780507749980892451018149909879321"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b467c8feac759f4c5c86d708beca2aa2b29584f",
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nft_set_desc_concat"
},
"id": "CVE-2025-21826-a74d9f42"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 565.0,
"function_hash": "111006780507749980892451018149909879321"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5083a7ae45003456c253e981b30a43f71230b4a3",
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nft_set_desc_concat"
},
"id": "CVE-2025-21826-a7c1a926"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"187245259883225429983034000993831642975",
"311703199331790373030499827695858946467",
"336176781971360906019725899395634999150",
"61200429283572909898597805020862979858",
"196360888918844303002642424536278224998",
"222593137439896764169371426866097620572",
"240832801201238492914297244471740652449",
"86862991049458059478327745378146058074",
"70953920739078041769421010377430045259",
"11821021757963023233348608933014079716",
"93824480709851279815117307805325495379"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5083a7ae45003456c253e981b30a43f71230b4a3",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2025-21826-b3711f76"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"187245259883225429983034000993831642975",
"311703199331790373030499827695858946467",
"336176781971360906019725899395634999150",
"61200429283572909898597805020862979858",
"196360888918844303002642424536278224998",
"222593137439896764169371426866097620572",
"240832801201238492914297244471740652449",
"86862991049458059478327745378146058074",
"70953920739078041769421010377430045259",
"11821021757963023233348608933014079716",
"93824480709851279815117307805325495379"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b9335a8000fb70742f7db10af314104b6ace220",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2025-21826-cf63ae2d"
}
]