LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38120: netfilter: nf_set_pipapo_avx2: fix initial map fill

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_set_pipapo_avx2: fix initial map fill If the first field doesn't cover the entire start map, then we must zero out the remainder, else we leak those bits into the next match round map. The early fix was incomplete and did only fix up the generic C implementation. A followup patch adds a test case to nft_concat_range.sh.

CriticalCVSS 9.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A flaw in an accelerated Linux nftables matching path can carry leftover match-state bits into later comparisons. This may cause incorrect firewall or packet-filter decisions when affected concatenated or range sets are used. The supplied rating is critical, but the sources do not show real-world exploitation or prove that every Linux host is exposed.

Executive priority

Treat this as urgent for Linux systems enforcing network boundaries with nftables concatenated or range sets, particularly AVX2-capable hosts. Inventory immediately and apply vendor-supported updates. Because exploitation evidence is absent, prioritize exposure confirmation alongside remediation rather than assuming compromise.

Technical view

The nf_set_pipapo_avx2 implementation failed to zero the unused remainder of an initial map when the first field did not cover it completely. Residual bits could contaminate the next matching-round map. An earlier correction covered only the generic C implementation; the linked stable-kernel changes address the AVX2 path and add regression coverage.

Likely exposure

Exposure appears limited to affected Linux kernels where nftables concatenated or range-set matching reaches the AVX2 PIPAPO implementation. Merely running Linux does not establish exposure. The supplied version data mixes release numbers and commit identifiers without sufficiently clear ranges, so kernel packages should be checked against distributor guidance and linked fixes.

Exploitation context

The bundle marks this CVE as absent from KEV, and no provided source reports active exploitation or public exploit availability. Although the supplied CVSS vector describes network access without privileges or interaction, the source description does not establish practical attacker reachability, required ruleset configuration, or a demonstrated compromise path.

Researcher notes

This appears to be internal match-map state contamination, not evidence that kernel memory contents are disclosed externally. Incorrect residual bits may produce false matches or nonmatches. The provided sources do not document attacker-controlled preconditions, observable impact, proof of concept, or complete introduced-and-fixed version ranges; those questions require vendor and upstream verification.

Mitigation direction

  • Inventory Linux hosts and compare running kernels with the CVE record and distributor advisories.
  • Prioritize vendor kernel updates that incorporate the linked stable fixes, then reboot into the updated kernel.
  • If patching is delayed, consult the Linux distributor for supported mitigations; none are specified in the provided sources.
  • Revalidate nftables policies after updating, especially concatenated range sets on AVX2-capable systems.

Validation and detection

  • Record the running kernel and distribution package version on every potentially exposed host.
  • Identify systems using nftables concatenated or range sets and whether the AVX2 PIPAPO path is available.
  • Confirm the installed package includes the applicable linked stable-kernel fix or distributor backport.
  • Run the referenced nft_concat_range.sh regression test in controlled staging where operationally appropriate.
  • After reboot, verify the updated kernel is active and confirm expected allow and deny decisions.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38120 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
9Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.4CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L3.95.5Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.4Critical
CVSS 3.1 vector shape for CVE-2025-38120Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux77bf0c4ab928ca4c9a99311f4f70ba0c17fecba9, 957a4d1c4c5849e4515c9fb4db21bf85318103dc, 9625c46ce6fd4f922595a4b32b1de5066d70464f, 69b6a67f7052905e928d75a0c5871de50e686986, 791a615b7ad2258c560f91852be54b0480837c93, 791a615b7ad2258c560f91852be54b0480837c93, 791a615b7ad2258c560f91852be54b0480837c93, 8058c88ac0df21239daee54b5934d5c80ca9685f, 5.15.165, 6.1.103, 6.6.44, 6.10.3unaffected
LinuxLinux6.11, 0, 5.15.186, 6.1.142, 6.6.94, 6.12.34, 6.15.3, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.