In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfsetpipapo_avx2: fix initial map fill
If the first field doesn't cover the entire start map, then we must zero out the remainder, else we leak those bits into the next match round map.
The early fix was incomplete and did only fix up the generic C implementation.
A followup patch adds a test case to nftconcatrange.sh.
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90bc7f5a244aadee4292b28098b7c98aadd4b3aa",
"deprecated": false,
"id": "CVE-2025-38120-59f3fc1b",
"target": {
"function": "nft_pipapo_avx2_lookup",
"file": "net/netfilter/nft_set_pipapo_avx2.c"
},
"digest": {
"function_hash": "180861568773010587138063164859358856898",
"length": 2135.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39bab2d3517b5b50c609b4f8c66129bf619fffa0",
"deprecated": false,
"id": "CVE-2025-38120-6d05fcfc",
"target": {
"function": "nft_pipapo_avx2_lookup",
"file": "net/netfilter/nft_set_pipapo_avx2.c"
},
"digest": {
"function_hash": "180861568773010587138063164859358856898",
"length": 2135.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39bab2d3517b5b50c609b4f8c66129bf619fffa0",
"deprecated": false,
"id": "CVE-2025-38120-89c4d672",
"target": {
"file": "net/netfilter/nft_set_pipapo_avx2.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"155878266402446139147906405940690301896",
"2845140298752947466822512434407990784",
"175367801479318058652168429831324382884",
"259947936596001155717110725512929236925",
"289023596162751617573001484332905235386",
"291759130400737014408963674356854289855"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@251496ce1728c9fd47bd2b20a7b21b20b9a020ca",
"deprecated": false,
"id": "CVE-2025-38120-b4559e29",
"target": {
"function": "nft_pipapo_avx2_lookup",
"file": "net/netfilter/nft_set_pipapo_avx2.c"
},
"digest": {
"function_hash": "180861568773010587138063164859358856898",
"length": 2135.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea77c397bff8b6d59f6d83dae1425b08f465e8b5",
"deprecated": false,
"id": "CVE-2025-38120-b8d4393e",
"target": {
"function": "nft_pipapo_avx2_lookup",
"file": "net/netfilter/nft_set_pipapo_avx2.c"
},
"digest": {
"function_hash": "180861568773010587138063164859358856898",
"length": 2135.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8068e1e42b46518ce680dc6470bcd710efc3fa0a",
"deprecated": false,
"id": "CVE-2025-38120-c2bd251e",
"target": {
"function": "nft_pipapo_avx2_lookup",
"file": "net/netfilter/nft_set_pipapo_avx2.c"
},
"digest": {
"function_hash": "180861568773010587138063164859358856898",
"length": 2135.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea77c397bff8b6d59f6d83dae1425b08f465e8b5",
"deprecated": false,
"id": "CVE-2025-38120-d427d8ea",
"target": {
"file": "net/netfilter/nft_set_pipapo_avx2.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"155878266402446139147906405940690301896",
"2845140298752947466822512434407990784",
"175367801479318058652168429831324382884",
"259947936596001155717110725512929236925",
"289023596162751617573001484332905235386",
"291759130400737014408963674356854289855"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90bc7f5a244aadee4292b28098b7c98aadd4b3aa",
"deprecated": false,
"id": "CVE-2025-38120-e057eb94",
"target": {
"file": "net/netfilter/nft_set_pipapo_avx2.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"155878266402446139147906405940690301896",
"2845140298752947466822512434407990784",
"175367801479318058652168429831324382884",
"259947936596001155717110725512929236925",
"289023596162751617573001484332905235386",
"291759130400737014408963674356854289855"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@251496ce1728c9fd47bd2b20a7b21b20b9a020ca",
"deprecated": false,
"id": "CVE-2025-38120-e6bc27a0",
"target": {
"file": "net/netfilter/nft_set_pipapo_avx2.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"155878266402446139147906405940690301896",
"2845140298752947466822512434407990784",
"175367801479318058652168429831324382884",
"259947936596001155717110725512929236925",
"289023596162751617573001484332905235386",
"291759130400737014408963674356854289855"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8068e1e42b46518ce680dc6470bcd710efc3fa0a",
"deprecated": false,
"id": "CVE-2025-38120-f7dcd293",
"target": {
"file": "net/netfilter/nft_set_pipapo_avx2.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"155878266402446139147906405940690301896",
"2845140298752947466822512434407990784",
"175367801479318058652168429831324382884",
"259947936596001155717110725512929236925",
"289023596162751617573001484332905235386",
"291759130400737014408963674356854289855"
]
},
"signature_type": "Line"
}
]