Skip to content
Fencer Intel
critical 9.4

CVE-2026-43114 in the critical feed json

netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

published 6mo ago modified 21d ago also EUVD-2026-27637

cvss
9.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 31%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

New test case fails unexpectedly when avx2 matching functions are used.

The test first loads a ranomly generated pipapo set with 'ipv4 . port' key, i.e. nft -f foo.

This works. Then, it reloads the set after a flush: (echo flush set t s; cat foo) | nft -f -

This is expected to work, because its the same set after all and it was already loaded once.

But with avx2, this fails: nft reports a clashing element.

The reported clash is of following form:

We successfully re-inserted a . b c . d

Then we try to insert a . d

avx2 finds the already existing a . d, which (due to 'flush set') is marked as invalid in the new generation. It skips the element and moves to next.

Due to incorrect masking, the skip-step finds the next matching element *only considering the first field*,

i.e. we return the already reinserted "a . b", even though the last field is different and the entry should not have been matched.

No such error is reported for the generic c implementation (no avx2) or when the last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback.

Bisection points to 7711f4bb4b36 ("netfilter: nft_set_pipapo: fix range overlap detection") but that fix merely uncovers this bug.

Before this commit, the wrong element is returned, but erronously reported as a full, identical duplicate.

The root-cause is too early return in the avx2 match functions. When we process the last field, we should continue to process data until the entire input size has been consumed to make sure no stale bits remain in the map.

Patch / fix

  • Linux Linux 7.0
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:6.12.0-55.103.1.el10_0
  • Red Hat Red Hat Enterprise Linux 9 0:5.14.0-687.42.1.el9_8
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:5.14.0-284.191.1.el9_2, 0:5.14.0-284.191.1.rt14.476.el9_2
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:5.14.0-427.149.1.el9_4
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:5.14.0-570.138.1.el9_6
  • Red Hat Red Hat OpenShift Container Platform 4.20 4.20.9.6.202609092300-0
  • Red Hat Red Hat OpenShift Container Platform 4.21 4.21.9.6.202609090322-0
  • Red Hat Red Hat OpenShift Container Platform 4.22 4.22.9.8.202609020733-0
  • linux Debian 12 6.1.176-1
  • linux Debian 13 6.12.85-1
  • linux Debian 14 6.19.14-1

debian advisories DEBIAN-CVE-2026-43114

  • linux Ubuntu 22.04 LTS 5.15.0-185.195
  • linux Ubuntu 24.04 LTS 6.8.0-134.134
  • linux Ubuntu 25.10 6.17.0-40.40
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1111.118
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1060.63
  • linux-aws Ubuntu 25.10 6.17.0-1019.19
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1111.121
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1063.69

ubuntu advisories UBUNTU-CVE-2026-43114

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kpatch-patch-6_12_0-211_16_1 RHEL 10.2 1-8.el10_2
  • kpatch-patch-5_14_0-687_10_1 RHEL 9 1-8.el9_8
  • kernel RHEL 9 5.14.0-687.42.1.el9_8
  • rv RHEL 9 5.14.0-687.42.1.el9_8
  • perf RHEL 9 5.14.0-687.42.1.el9_8
  • rtla RHEL 9 5.14.0-687.42.1.el9_8
  • libperf RHEL 9 5.14.0-687.42.1.el9_8
  • kernel-rt RHEL 9 5.14.0-687.42.1.el9_8

red hat advisories RHSA-2026:67723RHSA-2026:67721RHSA-2026:65712RHSA-2026:64767RHSA-2026:62641RHSA-2026:62642

  • kernel-rt Real Time Module 15 SP7 6.4.0-150700.7.72.1
  • kernel-syms-rt Real Time Module 15 SP7 6.4.0-150700.7.72.1
  • kernel-source-rt Real Time Module 15 SP7 6.4.0-150700.7.72.1
  • kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.78.1
  • kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.78.1
  • kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.53.78.1
  • kernel-source SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 6.4.0-150700.53.78.1
  • kernel-default SLE Workstation Extension 15 SP7, SLE Module for Legacy 15 SP7, SLE Module for Basesystem 15 SP7 +2 more 6.4.0-150700.53.78.1

suse advisories SUSE-SU-2026:3810-1SUSE-SU-2026:3790-1SUSE-SU-2026:23244-1SUSE-SU-2026:23241-1SUSE-SU-2026:23194-1SUSE-SU-2026:23193-1

  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.37.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-azure openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-source openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-default openSUSE Leap 16.0 6.12.0-160000.37.1

opensuse advisories openSUSE-SU-2026:21555-1

  • kernel AlmaLinux 9 5.14.0-687.42.1.el9_8
  • rv AlmaLinux 9 5.14.0-687.42.1.el9_8
  • perf AlmaLinux 9 5.14.0-687.42.1.el9_8
  • rtla AlmaLinux 9 5.14.0-687.42.1.el9_8
  • libperf AlmaLinux 9 5.14.0-687.42.1.el9_8
  • kernel-rt AlmaLinux 9 5.14.0-687.42.1.el9_8
  • kernel-64k AlmaLinux 9 5.14.0-687.42.1.el9_8
  • kernel-core AlmaLinux 9 5.14.0-687.42.1.el9_8

almalinux advisories ALSA-2026:59723

  • kernel Rocky Linux 9 5.14.0-687.42.1.el9_8

rocky linux advisories RLSA-2026:59723

Is CVE-2026-43114 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-43114 updated cvss 8.1

kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

  • Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more Red Hat Enterprise Linux 10 kernel Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8
    affected: workaround, no fix available
  • Red Hat CodeReady Linux Builder EUS (v.9.6) libperf 5.14.0-570.138.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-570.138.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-570.138.1.el9_6, kernel-debuginfo-common-aarch64 5.14.0-570.138.1.el9_6, kernel-debuginfo-common-ppc64le 5.14.0-570.138.1.el9_6
    fixed: vendor fix RHSA-2026:62568
  • Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-687.42.1.el9_8, perf 5.14.0-687.42.1.el9_8, rtla 5.14.0-687.42.1.el9_8, python3-perf 5.14.0-687.42.1.el9_8, kernel-devel-matched 5.14.0-687.42.1.el9_8, kernel-64k-devel-matched 5.14.0-687.42.1.el9_8, +7 more
    fixed: vendor fix RHSA-2026:59723
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) perf 5.14.0-284.191.1.el9_2, rtla 5.14.0-284.191.1.el9_2, kernel-devel-matched 5.14.0-284.191.1.el9_2, kernel-64k-devel-matched 5.14.0-284.191.1.el9_2, kernel-debug-devel-matched 5.14.0-284.191.1.el9_2, kernel-debuginfo-common-s390x 5.14.0-284.191.1.el9_2, +5 more
    fixed: vendor fix RHSA-2026:67723
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) rv 5.14.0-427.149.1.el9_4, perf 5.14.0-427.149.1.el9_4, rtla 5.14.0-427.149.1.el9_4, kernel-devel-matched 5.14.0-427.149.1.el9_4, kernel-64k-devel-matched 5.14.0-427.149.1.el9_4, kernel-debug-devel-matched 5.14.0-427.149.1.el9_4, +6 more
    fixed: vendor fix RHSA-2026:65712
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) rv 6.12.0-55.103.1.el10_0, perf 6.12.0-55.103.1.el10_0, rtla 6.12.0-55.103.1.el10_0, python3-perf 6.12.0-55.103.1.el10_0, kernel-devel-matched 6.12.0-55.103.1.el10_0, kernel-64k-devel-matched 6.12.0-55.103.1.el10_0, +7 more
    fixed: vendor fix RHSA-2026:64767
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) rv 5.14.0-570.138.1.el9_6, perf 5.14.0-570.138.1.el9_6, rtla 5.14.0-570.138.1.el9_6, python3-perf 5.14.0-570.138.1.el9_6, kernel-devel-matched 5.14.0-570.138.1.el9_6, kernel-64k-devel-matched 5.14.0-570.138.1.el9_6, +7 more
    fixed: vendor fix RHSA-2026:62568
  • Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-687.42.1.el9_8, kernel-64k 5.14.0-687.42.1.el9_8, kernel-core 5.14.0-687.42.1.el9_8, kernel-tools 5.14.0-687.42.1.el9_8, kernel-modules 5.14.0-687.42.1.el9_8, kernel-64k-core 5.14.0-687.42.1.el9_8, +28 more
    fixed: vendor fix RHSA-2026:59723
show 25 more
  • Red Hat Enterprise Linux BaseOS (v. 10) kpatch-patch-6_12_0-211_16_1 1-8.el10_2
    fixed: vendor fix RHSA-2026:62642
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) bpftool 7.0.0-284.191.1.el9_2, kernel 5.14.0-284.191.1.el9_2, kernel-64k 5.14.0-284.191.1.el9_2, kernel-core 5.14.0-284.191.1.el9_2, kernel-tools 5.14.0-284.191.1.el9_2, python3-perf 5.14.0-284.191.1.el9_2, +33 more
    fixed: vendor fix RHSA-2026:67723
  • Red Hat Enterprise Linux BaseOS E4S (v.9.4) bpftool 7.3.0-427.149.1.el9_4, kernel 5.14.0-427.149.1.el9_4, kernel-64k 5.14.0-427.149.1.el9_4, kernel-core 5.14.0-427.149.1.el9_4, kernel-tools 5.14.0-427.149.1.el9_4, python3-perf 5.14.0-427.149.1.el9_4, +33 more
    fixed: vendor fix RHSA-2026:65712
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel 6.12.0-55.103.1.el10_0, kernel-64k 6.12.0-55.103.1.el10_0, kernel-core 6.12.0-55.103.1.el10_0, kernel-tools 6.12.0-55.103.1.el10_0, kernel-modules 6.12.0-55.103.1.el10_0, kernel-64k-core 6.12.0-55.103.1.el10_0, +27 more
    fixed: vendor fix RHSA-2026:64767
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) kernel 5.14.0-570.138.1.el9_6, kernel-64k 5.14.0-570.138.1.el9_6, kernel-core 5.14.0-570.138.1.el9_6, kernel-tools 5.14.0-570.138.1.el9_6, kernel-modules 5.14.0-570.138.1.el9_6, kernel-64k-core 5.14.0-570.138.1.el9_6, +32 more
    fixed: vendor fix RHSA-2026:62568
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-687.42.1.el9_8, kernel-debuginfo-common-s390x 5.14.0-687.42.1.el9_8, kernel-debuginfo-common-x86_64 5.14.0-687.42.1.el9_8, kernel-debuginfo-common-aarch64 5.14.0-687.42.1.el9_8, kernel-debuginfo-common-ppc64le 5.14.0-687.42.1.el9_8
    fixed: vendor fix RHSA-2026:59723
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) libperf 6.12.0-55.103.1.el10_0, kernel-debuginfo-common-s390x 6.12.0-55.103.1.el10_0, kernel-debuginfo-common-x86_64 6.12.0-55.103.1.el10_0, kernel-debuginfo-common-aarch64 6.12.0-55.103.1.el10_0, kernel-debuginfo-common-ppc64le 6.12.0-55.103.1.el10_0
    fixed: vendor fix RHSA-2026:64767
  • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-687.42.1.el9_8, kernel-rt-64k 5.14.0-687.42.1.el9_8, kernel-rt-core 5.14.0-687.42.1.el9_8, kernel-rt-modules 5.14.0-687.42.1.el9_8, kernel-rt-64k-core 5.14.0-687.42.1.el9_8, kernel-rt-debug-core 5.14.0-687.42.1.el9_8, +14 more
    fixed: vendor fix RHSA-2026:59723
  • Red Hat Enterprise Linux Real Time E4S (v.9.2) kernel-rt 5.14.0-284.191.1.rt14.476.el9_2, kernel-rt-core 5.14.0-284.191.1.rt14.476.el9_2, kernel-rt-modules 5.14.0-284.191.1.rt14.476.el9_2, kernel-rt-debug-core 5.14.0-284.191.1.rt14.476.el9_2, kernel-rt-modules-core 5.14.0-284.191.1.rt14.476.el9_2, kernel-rt-debug-modules 5.14.0-284.191.1.rt14.476.el9_2, +4 more
    fixed: vendor fix RHSA-2026:67721
  • Red Hat Enterprise Linux Real Time E4S (v.9.4) kernel-rt 5.14.0-427.149.1.el9_4, kernel-rt-core 5.14.0-427.149.1.el9_4, kernel-rt-modules 5.14.0-427.149.1.el9_4, kernel-rt-debug-core 5.14.0-427.149.1.el9_4, kernel-rt-modules-core 5.14.0-427.149.1.el9_4, kernel-rt-debug-modules 5.14.0-427.149.1.el9_4, +4 more
    fixed: vendor fix RHSA-2026:65712
  • Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt 6.12.0-55.103.1.el10_0, kernel-rt-64k 6.12.0-55.103.1.el10_0, kernel-rt-core 6.12.0-55.103.1.el10_0, kernel-rt-modules 6.12.0-55.103.1.el10_0, kernel-rt-64k-core 6.12.0-55.103.1.el10_0, kernel-rt-debug-core 6.12.0-55.103.1.el10_0, +14 more
    fixed: vendor fix RHSA-2026:64767
  • Red Hat Enterprise Linux Real Time EUS (v.9.6) kernel-rt 5.14.0-570.138.1.el9_6, kernel-rt-64k 5.14.0-570.138.1.el9_6, kernel-rt-core 5.14.0-570.138.1.el9_6, kernel-rt-modules 5.14.0-570.138.1.el9_6, kernel-rt-64k-core 5.14.0-570.138.1.el9_6, kernel-rt-debug-core 5.14.0-570.138.1.el9_6, +14 more
    fixed: vendor fix RHSA-2026:62568
  • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-687.42.1.el9_8, kernel-rt-core 5.14.0-687.42.1.el9_8, kernel-rt-modules 5.14.0-687.42.1.el9_8, kernel-rt-debug-core 5.14.0-687.42.1.el9_8, kernel-rt-modules-core 5.14.0-687.42.1.el9_8, kernel-rt-debug-modules 5.14.0-687.42.1.el9_8, +4 more
    fixed: vendor fix RHSA-2026:59723
  • Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) kernel-rt 5.14.0-284.191.1.rt14.476.el9_2, kernel-rt-kvm 5.14.0-284.191.1.rt14.476.el9_2, kernel-rt-core 5.14.0-284.191.1.rt14.476.el9_2, kernel-rt-modules 5.14.0-284.191.1.rt14.476.el9_2, kernel-rt-debug-kvm 5.14.0-284.191.1.rt14.476.el9_2, kernel-rt-debug-core 5.14.0-284.191.1.rt14.476.el9_2, +6 more
    fixed: vendor fix RHSA-2026:67721
  • Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4) kernel-rt 5.14.0-427.149.1.el9_4, kernel-rt-kvm 5.14.0-427.149.1.el9_4, kernel-rt-core 5.14.0-427.149.1.el9_4, kernel-rt-modules 5.14.0-427.149.1.el9_4, kernel-rt-debug-kvm 5.14.0-427.149.1.el9_4, kernel-rt-debug-core 5.14.0-427.149.1.el9_4, +6 more
    fixed: vendor fix RHSA-2026:65712
  • Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) kernel-rt 6.12.0-55.103.1.el10_0, kernel-rt-kvm 6.12.0-55.103.1.el10_0, kernel-rt-core 6.12.0-55.103.1.el10_0, kernel-rt-modules 6.12.0-55.103.1.el10_0, kernel-rt-debug-kvm 6.12.0-55.103.1.el10_0, kernel-rt-debug-core 6.12.0-55.103.1.el10_0, +6 more
    fixed: vendor fix RHSA-2026:64767
  • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6) kernel-rt 5.14.0-570.138.1.el9_6, kernel-rt-kvm 5.14.0-570.138.1.el9_6, kernel-rt-core 5.14.0-570.138.1.el9_6, kernel-rt-modules 5.14.0-570.138.1.el9_6, kernel-rt-debug-kvm 5.14.0-570.138.1.el9_6, kernel-rt-debug-core 5.14.0-570.138.1.el9_6, +6 more
    fixed: vendor fix RHSA-2026:62568
  • Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202610242240
    fixed: vendor fix RHSA-2026:89838
  • Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202610242150
    fixed: vendor fix RHSA-2026:89714
  • Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202610242013
    fixed: vendor fix RHSA-2026:89725
  • Red Hat OpenShift Container Platform 4.19 rhcos 4.19.9.6.202609090147
    fixed: vendor fix RHSA-2026:66370
  • Red Hat OpenShift Container Platform 4.20 rhcos 4.20.9.6.202609092300
    fixed: vendor fix RHSA-2026:66376
  • Red Hat OpenShift Container Platform 4.21 rhcos 4.21.9.6.202609090322
    fixed: vendor fix RHSA-2026:66351
  • Red Hat OpenShift Container Platform 4.22 rhcos 4.22.9.8.202609020733
    fixed: vendor fix RHSA-2026:63093
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 10 libkrun
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-295-16 updated cvss 9.4

Siemens SIMATIC S7-1500 TM MFP

  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
24d ago

Exploit prediction

0.37% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CISA ADP 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

  • Linux Linux
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Container Platform 4.22
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Classification

Weakness
  • CWE-480 Use of Incorrect Operator
  • CWE-20 Improper Input Validation
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.