CyberSecBulletin
CVE-2026-43114NVD status: Modified

In the Linux kernel, the following vulnerability has been resolved: netfilter…

Published Updated By the CyberSecBulletin desk

CVE-2026-43114 is a critical-severity improper input validation vulnerability in Linux, with a CVSS 3.1 base score of 9.4 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions f8c39983fc9c1a978c82e6f2df7bfba8a8561587, c7babe2f28b507e17f28e9f753b7caec72d4857f, 1c43f0dd8691ddf8884793b481ddc7511cf593c3 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.37% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to f8c39983fc9c1a978c82e6f2df7bfba8a8561587 or c7babe2f28b507e17f28e9f753b7caec72d4857f or 1c43f0dd8691ddf8884793b481ddc7511cf593c3 or fa4f1f52528c73989d820f32bfca06bec5afeece, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.6.136 or 6.12.83 or 6.18.24 or 6.19.14, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux7400b063969bdca4a06cd97f1294d765c8eecbe1 up to, but not including, f8c39983fc9c1a978c82e6f2df7bfba8a8561587; 7400b063969bdca4a06cd97f1294d765c8eecbe1 up to, but not including, c7babe2f28b507e17f28e9f753b7caec72d4857f; 7400b063969bdca4a06cd97f1294d765c8eecbe1 up to, but not including, 1c43f0dd8691ddf8884793b481ddc7511cf593c3; 7400b063969bdca4a06cd97f1294d765c8eecbe1 up to, but not including, fa4f1f52528c73989d820f32bfca06bec5afeece; 7400b063969bdca4a06cd97f1294d765c8eecbe1 up to, but not including, 3d53f9aafd469ae1ea27051e00f5b96ca1b55d52; 7400b063969bdca4a06cd97f1294d765c8eecbe1 up to, but not including, 07de44424bb7f17ef9357e8535df96d9e97c40cb; 7400b063969bdca4a06cd97f1294d765c8eecbe1 up to, but not including, 0abbc43f71d99baadeeba6fa3fe1c80b676f57ed; 7400b063969bdca4a06cd97f1294d765c8eecbe1 up to, but not including, d3c0037ffe1273fa1961e779ff6906234d6cf53c; and 1 more rangesf8c39983fc9c1a978c82e6f2df7bfba8a8561587, c7babe2f28b507e17f28e9f753b7caec72d4857f, 1c43f0dd8691ddf8884793b481ddc7511cf593c3, fa4f1f52528c73989d820f32bfca06bec5afeece, 3d53f9aafd469ae1ea27051e00f5b96ca1b55d52, 07de44424bb7f17ef9357e8535df96d9e97c40cb
Red HatRed Hat Enterprise Linux 10Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 10.0 Extended Update SupportNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP SolutionsNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP SolutionsNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9.6 Extended Update SupportNot specified in the recordNot stated
Red HatRed Hat OpenShift Container Platform 4.20Not specified in the recordNot stated
Red HatRed Hat OpenShift Container Platform 4.21Not specified in the recordNot stated
Red HatRed Hat OpenShift Container Platform 4.22Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 6Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 7Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8Not specified in the recordNot stated
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystemall versionsNot stated
LinuxLinux Kernel5.7 up to, but not including, 6.6.136; 6.7 up to, but not including, 6.12.83; 6.13 up to, but not including, 6.18.24; 6.19 up to, but not including, 6.19.14; 7.06.6.136, 6.12.83, 6.18.24, 6.19.14

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
LowPerformance or availability is reduced.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. Scored by CNA.

Scoring systemScoreSeverityScored by
CVSS 3.19.4CriticalCNA
CVSS 3.18.1HighCNA

Official description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry New test case fails unexpectedly when avx2 matching functions are used. The test first loads a ranomly generated pipapo set with 'ipv4 . port' key, i.e. nft -f foo. This works. Then, it reloads the set after a flush: (echo flush set t s; cat foo) | nft -f - This is expected to work, because its the same set after all and it was already loaded once. But with avx2, this fails: nft reports a clashing element. The reported clash is of following form: We successfully re-inserted a . b c . d Then we try to insert a . d avx2 finds the already existing a . d, which (due to 'flush set') is marked as invalid in the new generation. It skips the element and moves to next. Due to incorrect masking, the skip-step finds the next matching element *only considering the first field*, i.e. we return the already reinserted "a . b", even though the last field is different and the entry should not have been matched. No such error is reported for the generic c implementation (no avx2) or when the last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback. Bisection points to 7711f4bb4b36 ("netfilter: nft_set_pipapo: fix range overlap detection") but that fix merely uncovers this bug. Before this commit, the wrong element is returned, but erronously reported as a full, identical duplicate. The root-cause is too early return in the avx2 match functions. When we process the last field, we should continue to process data until the entire input size has been consumed to make sure no stale bits remain in the map.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

How developers prevent this class of flaw

  • Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build recognizers for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses.
  • Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
  • Understand all the potential areas where untrusted inputs can enter the product, including but not limited to: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.

More Improper Input Validation vulnerabilities (CWE-20)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Input Validation vulnerabilities

Spotted an error? Tell us.