GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72252 (GCVE-0-2026-72252)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:54 – Updated: 2026-08-23 12:47
VLAI
Title
netfilter: nft_set_pipapo: don't leak bad clone into future transaction
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nft_pipapo_match can enter a bad state: - some fields can have their lookup tables resized while others did not - bits might have been toggled - scratch map can be undersized which also means m->bsize_max can be lower than what is required This means that the next insertion in the same batch can trigger out-of-bounds writes. Furthermore, a failure in the first can result in the bad clone to leak into the next transaction because the abort callback is never executed in this case (the upper layer saw an error and no attempt to allocate a transactional request was made). Record a state for the nft_pipapo_match structure: - NEW (pristine clone) - MOD (modified clone with good state) - ERR (potentially bogus content) Then make it so that deletes and insertions fail when the clone entered ERR state. In case the very first insert attempt results in an error, free the clone right away.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3c4287f62044a90e73a561aa05fc46e62da173da , < 0ab7b1802f63ca5b288ea59acb467830b83abd6b (git)
Affected: 3c4287f62044a90e73a561aa05fc46e62da173da , < cc53703f48558896295f565cd4f5e956d21b7af4 (git)
Affected: 3c4287f62044a90e73a561aa05fc46e62da173da , < 047e813324eac2ac60cddfb58bcdbd0144eadb09 (git)
Affected: 3c4287f62044a90e73a561aa05fc46e62da173da , < 610e3b73efaec3dd81a95dcda2421ad7d9795bd0 (git)
Affected: 3c4287f62044a90e73a561aa05fc46e62da173da , < 02b6b0e892aea582590671796fd6eff5b93ea93f (git)
Affected: 3c4287f62044a90e73a561aa05fc46e62da173da , < e74f9680e1b64872a51cc7b5bda1edaaa08aa51f (git)
Affected: 3c4287f62044a90e73a561aa05fc46e62da173da , < 47e65eff50691f0a5b79d325e28d83ec1da43bcf (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.6
Unaffected: 0 , < 5.6 (semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_set_pipapo.c",
            "net/netfilter/nft_set_pipapo.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0ab7b1802f63ca5b288ea59acb467830b83abd6b",
              "status": "affected",
              "version": "3c4287f62044a90e73a561aa05fc46e62da173da",
              "versionType": "git"
            },
            {
              "lessThan": "cc53703f48558896295f565cd4f5e956d21b7af4",
              "status": "affected",
              "version": "3c4287f62044a90e73a561aa05fc46e62da173da",
              "versionType": "git"
            },
            {
              "lessThan": "047e813324eac2ac60cddfb58bcdbd0144eadb09",
              "status": "affected",
              "version": "3c4287f62044a90e73a561aa05fc46e62da173da",
              "versionType": "git"
            },
            {
              "lessThan": "610e3b73efaec3dd81a95dcda2421ad7d9795bd0",
              "status": "affected",
              "version": "3c4287f62044a90e73a561aa05fc46e62da173da",
              "versionType": "git"
            },
            {
              "lessThan": "02b6b0e892aea582590671796fd6eff5b93ea93f",
              "status": "affected",
              "version": "3c4287f62044a90e73a561aa05fc46e62da173da",
              "versionType": "git"
            },
            {
              "lessThan": "e74f9680e1b64872a51cc7b5bda1edaaa08aa51f",
              "status": "affected",
              "version": "3c4287f62044a90e73a561aa05fc46e62da173da",
              "versionType": "git"
            },
            {
              "lessThan": "47e65eff50691f0a5b79d325e28d83ec1da43bcf",
              "status": "affected",
              "version": "3c4287f62044a90e73a561aa05fc46e62da173da",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_set_pipapo.c",
            "net/netfilter/nft_set_pipapo.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: don\u0027t leak bad clone into future transaction\n\nOn memory allocation failure the cloned nft_pipapo_match can enter a bad\nstate:\n - some fields can have their lookup tables resized while others did\n   not\n - bits might have been toggled\n - scratch map can be undersized which also means m-\u003ebsize_max can be\n   lower than what is required\n\nThis means that the next insertion in the same batch can trigger\nout-of-bounds writes.\n\nFurthermore, a failure in the first can result in the bad clone to\nleak into the next transaction because the abort callback is never\nexecuted in this case (the upper layer saw an error and no attempt to\nallocate a transactional request was made).\n\nRecord a state for the nft_pipapo_match structure:\n- NEW (pristine clone)\n- MOD (modified clone with good state)\n- ERR (potentially bogus content)\n\nThen make it so that deletes and insertions fail when the clone\nentered ERR state.\n\nIn case the very first insert attempt results in an error, free the\nclone right away."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via the nf_tables netlink control path (NFT_MSG_NEWSETELEM into nft_pipapo_insert); it is not triggered by remote packet handling, so attack vector is Local per kernel nftables guidance.\nAC:L - An attacker can reliably induce the needed allocation failure by crafting wide pipapo interval elements and constraining memory (e.g., memcg limits), then retrying until a partial insert leaves a corrupted clone that the next add reuses.\nPR:L - All nf_tables netlink operations require CAP_NET_ADMIN; on systems with unprivileged user namespaces this capability is obtainable by a normal local user via unshare -Urn, so privileges required are Low rather than High.\nUI:N - Exploitation requires only attacker-controlled nftables set element insertions and does not depend on any victim user action such as opening files or mounting filesystems.\nS:U - Impact is kernel heap corruption and potential privilege escalation within the same kernel security domain; it does not inherently cross VM, IOMMU, or other sandbox boundaries without separate exploitation.\nC:H - A partially updated pipapo clone leaves inconsistent lookup/mapping tables and undersized scratch buffers; subsequent inserts or lookups can perform out-of-bounds heap access that is exploitable for arbitrary kernel memory disclosure.\nI:H - The fix commit explicitly states the corrupted clone can cause out-of-bounds writes on the next insertion, enabling heap corruption that can be leveraged for arbitrary kernel writes and local privilege escalation.\nA:H - Out-of-bounds writes into kernel heap structures commonly cause kernel oops/panic or persistent instability; memory corruption from this bug can crash the system even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:06.920Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0ab7b1802f63ca5b288ea59acb467830b83abd6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc53703f48558896295f565cd4f5e956d21b7af4"
        },
        {
          "url": "https://git.kernel.org/stable/c/047e813324eac2ac60cddfb58bcdbd0144eadb09"
        },
        {
          "url": "https://git.kernel.org/stable/c/610e3b73efaec3dd81a95dcda2421ad7d9795bd0"
        },
        {
          "url": "https://git.kernel.org/stable/c/02b6b0e892aea582590671796fd6eff5b93ea93f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e74f9680e1b64872a51cc7b5bda1edaaa08aa51f"
        },
        {
          "url": "https://git.kernel.org/stable/c/47e65eff50691f0a5b79d325e28d83ec1da43bcf"
        }
      ],
      "title": "netfilter: nft_set_pipapo: don\u0027t leak bad clone into future transaction",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72252",
    "datePublished": "2026-08-15T05:54:40.740Z",
    "dateReserved": "2026-08-09T03:40:39.915Z",
    "dateUpdated": "2026-08-23T12:47:06.920Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72252",
      "date": "2026-09-05",
      "epss": "0.00164",
      "percentile": "0.05901"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72252\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:21:52.600\",\"lastModified\":\"2026-08-23T13:16:42.347\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nft_set_pipapo: don\u0027t leak bad clone into future transaction\\n\\nOn memory allocation failure the cloned nft_pipapo_match can enter a bad\\nstate:\\n - some fields can have their lookup tables resized while others did\\n   not\\n - bits might have been toggled\\n - scratch map can be undersized which also means m-\u003ebsize_max can be\\n   lower than what is required\\n\\nThis means that the next insertion in the same batch can trigger\\nout-of-bounds writes.\\n\\nFurthermore, a failure in the first can result in the bad clone to\\nleak into the next transaction because the abort callback is never\\nexecuted in this case (the upper layer saw an error and no attempt to\\nallocate a transactional request was made).\\n\\nRecord a state for the nft_pipapo_match structure:\\n- NEW (pristine clone)\\n- MOD (modified clone with good state)\\n- ERR (potentially bogus content)\\n\\nThen make it so that deletes and insertions fail when the clone\\nentered ERR state.\\n\\nIn case the very first insert attempt results in an error, free the\\nclone right away.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/netfilter/nft_set_pipapo.c\",\"net/netfilter/nft_set_pipapo.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3c4287f62044a90e73a561aa05fc46e62da173da\",\"lessThan\":\"0ab7b1802f63ca5b288ea59acb467830b83abd6b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c4287f62044a90e73a561aa05fc46e62da173da\",\"lessThan\":\"cc53703f48558896295f565cd4f5e956d21b7af4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c4287f62044a90e73a561aa05fc46e62da173da\",\"lessThan\":\"047e813324eac2ac60cddfb58bcdbd0144eadb09\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c4287f62044a90e73a561aa05fc46e62da173da\",\"lessThan\":\"610e3b73efaec3dd81a95dcda2421ad7d9795bd0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c4287f62044a90e73a561aa05fc46e62da173da\",\"lessThan\":\"02b6b0e892aea582590671796fd6eff5b93ea93f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c4287f62044a90e73a561aa05fc46e62da173da\",\"lessThan\":\"e74f9680e1b64872a51cc7b5bda1edaaa08aa51f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c4287f62044a90e73a561aa05fc46e62da173da\",\"lessThan\":\"47e65eff50691f0a5b79d325e28d83ec1da43bcf\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/netfilter/nft_set_pipapo.c\",\"net/netfilter/nft_set_pipapo.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.217\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.184\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/02b6b0e892aea582590671796fd6eff5b93ea93f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/047e813324eac2ac60cddfb58bcdbd0144eadb09\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/0ab7b1802f63ca5b288ea59acb467830b83abd6b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/47e65eff50691f0a5b79d325e28d83ec1da43bcf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/610e3b73efaec3dd81a95dcda2421ad7d9795bd0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cc53703f48558896295f565cd4f5e956d21b7af4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e74f9680e1b64872a51cc7b5bda1edaaa08aa51f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T17:59:15+00:00",
      "cve": "CVE-2026-72252",
      "id": "CVE-2026-72252",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nft_set_pipapo: don\u0027t leak bad clone into future transaction",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72252.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.