In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfsetpipapo_avx2: fix initial map fill
If the first field doesn't cover the entire start map, then we must zero out the remainder, else we leak those bits into the next match round map.
The early fix was incomplete and did only fix up the generic C implementation.
A followup patch adds a test case to nftconcatrange.sh.
[
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-38120-59f3fc1b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90bc7f5a244aadee4292b28098b7c98aadd4b3aa",
"digest": {
"length": 2135.0,
"function_hash": "180861568773010587138063164859358856898"
},
"deprecated": false,
"target": {
"file": "net/netfilter/nft_set_pipapo_avx2.c",
"function": "nft_pipapo_avx2_lookup"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-38120-6d05fcfc",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39bab2d3517b5b50c609b4f8c66129bf619fffa0",
"digest": {
"length": 2135.0,
"function_hash": "180861568773010587138063164859358856898"
},
"deprecated": false,
"target": {
"file": "net/netfilter/nft_set_pipapo_avx2.c",
"function": "nft_pipapo_avx2_lookup"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2025-38120-89c4d672",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39bab2d3517b5b50c609b4f8c66129bf619fffa0",
"digest": {
"line_hashes": [
"155878266402446139147906405940690301896",
"2845140298752947466822512434407990784",
"175367801479318058652168429831324382884",
"259947936596001155717110725512929236925",
"289023596162751617573001484332905235386",
"291759130400737014408963674356854289855"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "net/netfilter/nft_set_pipapo_avx2.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-38120-b4559e29",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@251496ce1728c9fd47bd2b20a7b21b20b9a020ca",
"digest": {
"length": 2135.0,
"function_hash": "180861568773010587138063164859358856898"
},
"deprecated": false,
"target": {
"file": "net/netfilter/nft_set_pipapo_avx2.c",
"function": "nft_pipapo_avx2_lookup"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-38120-b8d4393e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea77c397bff8b6d59f6d83dae1425b08f465e8b5",
"digest": {
"length": 2135.0,
"function_hash": "180861568773010587138063164859358856898"
},
"deprecated": false,
"target": {
"file": "net/netfilter/nft_set_pipapo_avx2.c",
"function": "nft_pipapo_avx2_lookup"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2025-38120-c19b9d8a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5ad58285f9217d68cd5ea2ad86ce254a3fe7c4d",
"digest": {
"line_hashes": [
"155878266402446139147906405940690301896",
"2845140298752947466822512434407990784",
"175367801479318058652168429831324382884",
"259947936596001155717110725512929236925",
"289023596162751617573001484332905235386",
"291759130400737014408963674356854289855"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "net/netfilter/nft_set_pipapo_avx2.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-38120-c2bd251e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8068e1e42b46518ce680dc6470bcd710efc3fa0a",
"digest": {
"length": 2135.0,
"function_hash": "180861568773010587138063164859358856898"
},
"deprecated": false,
"target": {
"file": "net/netfilter/nft_set_pipapo_avx2.c",
"function": "nft_pipapo_avx2_lookup"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2025-38120-d427d8ea",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea77c397bff8b6d59f6d83dae1425b08f465e8b5",
"digest": {
"line_hashes": [
"155878266402446139147906405940690301896",
"2845140298752947466822512434407990784",
"175367801479318058652168429831324382884",
"259947936596001155717110725512929236925",
"289023596162751617573001484332905235386",
"291759130400737014408963674356854289855"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "net/netfilter/nft_set_pipapo_avx2.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-38120-d82e0153",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5ad58285f9217d68cd5ea2ad86ce254a3fe7c4d",
"digest": {
"length": 2135.0,
"function_hash": "180861568773010587138063164859358856898"
},
"deprecated": false,
"target": {
"file": "net/netfilter/nft_set_pipapo_avx2.c",
"function": "nft_pipapo_avx2_lookup"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2025-38120-e057eb94",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90bc7f5a244aadee4292b28098b7c98aadd4b3aa",
"digest": {
"line_hashes": [
"155878266402446139147906405940690301896",
"2845140298752947466822512434407990784",
"175367801479318058652168429831324382884",
"259947936596001155717110725512929236925",
"289023596162751617573001484332905235386",
"291759130400737014408963674356854289855"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "net/netfilter/nft_set_pipapo_avx2.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2025-38120-e6bc27a0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@251496ce1728c9fd47bd2b20a7b21b20b9a020ca",
"digest": {
"line_hashes": [
"155878266402446139147906405940690301896",
"2845140298752947466822512434407990784",
"175367801479318058652168429831324382884",
"259947936596001155717110725512929236925",
"289023596162751617573001484332905235386",
"291759130400737014408963674356854289855"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "net/netfilter/nft_set_pipapo_avx2.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2025-38120-f7dcd293",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8068e1e42b46518ce680dc6470bcd710efc3fa0a",
"digest": {
"line_hashes": [
"155878266402446139147906405940690301896",
"2845140298752947466822512434407990784",
"175367801479318058652168429831324382884",
"259947936596001155717110725512929236925",
"289023596162751617573001484332905235386",
"291759130400737014408963674356854289855"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "net/netfilter/nft_set_pipapo_avx2.c"
}
}
]