CVE-2026-43114: Linux Kernel Netfilter Matching Vulnerability

CVE-2026-43114 Overview

CVE-2026-43114 is a Linux kernel vulnerability in the netfilter nft_set_pipapo_avx2 AVX2 matching functions. The flaw causes the pipapo set lookup to return a non-matching entry when an element in the set has been marked invalid for the new generation, typically after a flush set followed by re-insertion. Because the AVX2 fast path returns too early when processing the last field, stale bits remain in the match map. As a result, lookups can return entries that match only on the first field of a multi-field key such as ipv4 . port. The defect was uncovered by commit 7711f4bb4b36 ("netfilter: nft_set_pipapo: fix range overlap detection") but originates in the AVX2 lookup logic itself.

Critical Impact
Incorrect set-element matching in nftables can cause spurious clash errors during ruleset reloads and produce inconsistent packet-classification decisions on AVX2-capable kernels.

Affected Products

Linux kernel builds using the nft_set_pipapo_avx2 matching backend
Systems running nftables with multi-field pipapo sets (for example ipv4 . port)
x86_64 hosts with AVX2 support where the AVX2 fast path is selected over the generic C implementation

Discovery Timeline

2026-05-06 - CVE-2026-43114 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43114

Vulnerability Analysis

The nft_set_pipapo data structure implements multi-dimensional range matching used by nftables sets with composite keys. The AVX2 specialization accelerates lookups using vectorized bitmap intersections across each field of the key. When an existing element is marked invalid in the current generation, for example after nft -f - reloads the set with flush set t s prepended, the AVX2 lookup must skip that invalid entry and continue scanning subsequent candidates.

During the skip step on the final field, the AVX2 code returns before consuming the entire input width. Stale bits in the match bitmap remain set from earlier iterations, causing the function to report a hit on an element that only matches on prior fields. In the reproducer, inserting a . d after a . b and c . d were re-inserted causes AVX2 to return the previously inserted a . b, triggering a false clash error from nft.

Root Cause

The root cause is premature termination of the AVX2 match loop when processing the last field of the pipapo key. The implementation must iterate until all input bytes are consumed so the per-field intersection map fully reflects the last field. Truncating early leaves residual bits from earlier fields, which the lookup then interprets as a successful match. The generic C implementation and the nft_pipapo_avx2_lookup_slow fallback do not exhibit this behavior.

Attack Vector

Exploitation is limited to local interactions with the nftables subsystem. An administrator or process with CAP_NET_ADMIN reloading sets with multi-field keys observes incorrect clash errors and, in subtle cases, mismatched packet classification. The vulnerability is a logic flaw in kernel data-path code rather than a memory-corruption primitive, and there is no public evidence of remote exploitation. The fix is delivered as a series of kernel commits that ensure AVX2 match functions process the full input width before returning. See the upstream commits 07de44424b, 0abbc43f71, 3d53f9aafd, d3c0037ffe, and fa4f1f5285.

Detection Methods for CVE-2026-43114

Indicators of Compromise

Unexpected File exists or clash errors from nft -f when reloading rulesets that use pipapo sets with multi-field keys such as ipv4 . port.
Discrepancies between nft list set output and observed packet-matching behavior on AVX2-capable hosts.
Successful ruleset reloads on non-AVX2 systems that fail on AVX2 systems with otherwise identical inputs.

Detection Strategies

Compare running kernel versions against the patched stable trees referenced in the upstream commits to confirm whether the AVX2 fix is applied.
Run the upstream nftables selftest that adds the regression case for pipapo flush set reloads to validate behavior.
Audit kernel configuration for CONFIG_NFT_SET_PIPAPO_AVX2 and verify the host CPU advertises AVX2 to determine exposure.

Monitoring Recommendations

Log and alert on nftables ruleset load failures from configuration management tooling, since spurious clashes are the most visible symptom.
Track kernel package versions across the fleet and flag hosts that lag behind the stable releases containing the netfilter fix.
Capture dmesg and audit logs around nft operations to correlate set-reload failures with kernel build identifiers.

How to Mitigate CVE-2026-43114

Immediate Actions Required

Apply the latest stable kernel update from your distribution that includes the netfilter nft_set_pipapo_avx2 fix.
Reboot affected hosts after the kernel package is installed so the patched netfilter module is loaded.
Re-run any ruleset deployments that previously failed with clash errors to confirm correct behavior post-patch.

Patch Information

The fix is upstreamed in the Linux stable tree across the commits 07de44424b, 0abbc43f71, 3d53f9aafd, d3c0037ffe, and fa4f1f5285. The patches ensure the AVX2 match functions continue processing until the full input size has been consumed, eliminating stale bits in the per-field map.

Workarounds

Disable the AVX2 pipapo backend by booting a kernel built without CONFIG_NFT_SET_PIPAPO_AVX2 or by using a kernel that falls back to the generic C implementation.
Reformulate affected sets to avoid multi-field pipapo keys until the patched kernel is deployed, where operationally feasible.
Reload rulesets without the flush set prefix when refreshing existing sets, which avoids the invalid-generation skip path that triggers the bug.

bash

# Verify kernel version contains the fix and inspect pipapo set behavior
uname -r
modinfo nf_tables | grep -i version
nft list set inet filter s