netfilter: nf_tables: reject mismatching sum of field_len with set key length

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject mismatching sum of field_len with set key length The field length description provides the length of each separated key field in the concatenation, each field gets rounded up to 32-bits to calculate the pipapo rule width from pipapo_init(). The set key length provides the total size of the key aligned to 32-bits. Register-based arithmetics still allows for combining mismatching set key length and field length description, eg. set key length 10 and field description [ 5, 4 ] leading to pipapo width of 12.

Timeline

1. Mar 6, 2025, 4:04 PM UTCCVE published
2. Oct 15, 2026, 1:04 AM UTCRecord last updated

Affected versions

• Linux Linux

  From 2d4c0798a1ef8db15b3277697ac2def4eda42312 · fixed in 6b467c8feac759f4c5c86d708beca2aa2b29584f; From 77be8c495a3f841e88b46508cc20d3d7d3289da3 · fixed in 5083a7ae45003456c253e981b30a43f71230b4a3; From 9cb084df01e198119de477ac691d682fb01e80f3 · fixed in 2ac254343d3cf228ae0738b2615fedf85d000752; From dc45bb00e66a33de1abb29e3d587880e1d4d9a7e · fixed in 82e491e085719068179ff6a5466b7387cc4bbf32; From 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 · fixed in 49b7182b97bafbd5645414aff054b4a65d05823d; From 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 · fixed in ab50d0eff4a939d20c37721fd9766347efcdb6f6; From 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 · fixed in 1b9335a8000fb70742f7db10af314104b6ace220; From 5.10.209 · fixed in 5.10.235; From 5.15.148 · fixed in 5.15.179; From 6.1.75 · fixed in 6.1.129; From 6.6.14 · fixed in 6.6.76; From 6.7.2 · fixed in 6.8

• Linux Linux

  6.8

• KernelLinux

  fixed in 5.10.235; From 5.11.0 · fixed in 5.15.179; From 5.16.0 · fixed in 6.1.129; From 6.2.0 · fixed in 6.6.76; From 6.7.0 · fixed in 6.12.13; From 6.8.0 · fixed in 6.13.2

References 7