CVE-2026-43453 Overview
CVE-2026-43453 is a stack out-of-bounds read vulnerability in the Linux kernel's netfilter subsystem, specifically in the nft_set_pipapo module. The flaw resides in the pipapo_drop() function, which reads one element past the end of the stack-allocated rulemap array on its final loop iteration. KASAN confirms the out-of-bounds access reads 4 bytes beyond the 128-byte rulemap buffer declared with NFT_PIPAPO_MAX_FIELDS == 16.
Critical Impact
The vulnerability triggers an out-of-bounds stack read in kernel space, which can lead to information disclosure or kernel instability when manipulating nftables pipapo sets.
Affected Products
- Linux kernel netfilter subsystem (nft_set_pipapo module)
- Linux distributions shipping affected stable kernel branches prior to the listed fix commits
- Systems using nftables sets with the pipapo lookup algorithm
Discovery Timeline
- 2026-05-08 - CVE-2026-43453 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43453
Vulnerability Analysis
The vulnerability lives in pipapo_drop() within the Linux kernel's nft_set_pipapo implementation. The function iterates over the pipapo set's fields and calls pipapo_unmap() for each entry. On every iteration, including the final one, the call site passes rulemap[i + 1].n as the to_offset argument. When i == m->field_count - 1, this index references memory immediately past the end of the rulemap array.
The rulemap array is declared on the stack with a fixed size of NFT_PIPAPO_MAX_FIELDS (16). KASAN flagged the read of 4 bytes at offset 164, exactly 4 bytes beyond the 32–160 byte stack frame allocated for rulemap. Although pipapo_unmap() returns early when is_last is true and never consumes the value, C evaluates function arguments at the call site before the callee executes. This makes the read a real, observable out-of-bounds access.
Root Cause
The root cause is unconditional indexing of rulemap[i + 1] without bounding i + 1 against m->field_count. The argument expression is evaluated for every loop iteration regardless of whether the callee uses it. The fix passes 0 instead of rulemap[i + 1].n on the final iteration to suppress the boundary read.
Attack Vector
Exploitation requires the ability to manipulate nftables pipapo sets, which typically demands CAP_NET_ADMIN privileges within a network namespace. On systems where unprivileged user namespaces are permitted, a local low-privileged user can reach the affected code path. The out-of-bounds read can disclose adjacent stack contents or destabilize the kernel under specific stack layouts.
The vulnerability manifests in the pipapo_drop() rule removal logic. See the upstream kernel commits referenced below for the exact patch hunks.
Detection Methods for CVE-2026-43453
Indicators of Compromise
- KASAN reports containing stack-out-of-bounds in pipapo_drop followed by an offset of 4 bytes past a 128-byte rulemap frame
- Unexpected kernel oops or warnings originating from nf_tables during nftables set element deletion
- Audit logs showing unprivileged processes creating or modifying nftables sets via user namespaces
Detection Strategies
- Enable KASAN on test and staging kernels to surface the exact out-of-bounds read at pipapo_drop+0x50c
- Correlate nft command execution with subsequent kernel ring buffer anomalies in centralized logging
- Monitor for unexpected use of unshare(CLONE_NEWUSER|CLONE_NEWNET) followed by netfilter ruleset modifications
Monitoring Recommendations
- Track running kernel versions across the fleet and compare against the fixed stable branches listed in the kernel.org commit references
- Alert on dmesg entries containing KASAN, nf_tables, or pipapo substrings
- Audit sysctl kernel.unprivileged_userns_clone settings to identify hosts where low-privileged users can reach the vulnerable code path
How to Mitigate CVE-2026-43453
Immediate Actions Required
- Apply the upstream kernel patches from the referenced stable trees to all affected hosts as soon as your distribution publishes them
- Inventory systems exposing netfilter administration to non-root users or container workloads with CAP_NET_ADMIN
- Restrict creation of unprivileged user namespaces where the workload does not require them
Patch Information
The fix replaces the unsafe argument expression with 0 on the final loop iteration of pipapo_drop(), eliminating the out-of-bounds read. The patch is available in multiple stable branches via the following commits: 0a55d62, 1957e79, 324b749, 57fb87c, 60c1d18, d6d8cd2, dfbdac7, and e047f6f.
Workarounds
- Disable unprivileged user namespaces on hosts that do not require them by setting kernel.unprivileged_userns_clone=0
- Remove or restrict CAP_NET_ADMIN from workloads that do not need to manage nftables rulesets
- Avoid loading the nft_set_pipapo module on systems that do not require concatenated set lookups, where operationally feasible
# Configuration example: restrict unprivileged user namespaces
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-userns.conf
# Verify running kernel version against patched stable branches
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
