The vulnerability lies in the AVX2‑accelerated match functions of nftables’ pipapo sets. An early return causes the mask for the final field to be ignored, yielding a duplicate entry that should have been discarded. This logic error, identified as CWE‑20, can cause a packet that matches a previously valid key to be treated as a duplicate, potentially dropping legitimate traffic or enabling an attacker to corrupt set entries. The bug manifests during set reloads after a flush, where a non‑matching element is mistakenly reported as a match.

All Linux kernel distributions shipping kernels that include the buggy nv_set pipapo AVX2 implementation are affected. The CPE list indicates all variants of linux_kernel, including release candidates 7.0 rc1 through rc5. Accordingly, Red Hat, Ubuntu, Debian, Fedora and other mainstream distributions that ship a kernel with AVX2 support for nftables are impacted. Any host running a kernel with the nat‑avx2 path enabled is susceptible, regardless of the specific distro.

The CVSS score of 9.4 ranks this as a critical flaw, however the EPSS score of < 1 % suggests a very low probability of exploitation in the wild. It is not currently listed in CISA’s KEV catalogue. The attack requires local or privileged access to nftables configuration and the ability to trigger a flush and reload of a pipapo set, so remote exploitation is unlikely. Still, because it can disrupt packet filtering, an internal adversary could cause a denial‑of‑service or traffic diversion in environments that rely on nftables for security.