The Linux kernel’s nftables pipapo implementation uses AVX2‑accelerated match functions. A flaw in these functions causes an early return and incorrect masking of the last field in a multi‑field key, demonstrating a CWE‑480 type weakness in the AVX2 match logic. Consequently, when a pipapo set is reloaded after a flush, the system incorrectly reports a non‑matching entry as a duplicate. This misidentification can lead to legitimate packets being dropped or the set behaving unpredictably, potentially causing a denial of service in environments that depend on nftables for packet filtering.

All Linux kernel distributions that ship the impacted version of nftables with AVX2 optimizations. The bug affects the generic nft_set pipapo functions that support multi‑field keys, such as the ‘ipv4 . port’ key pair. Users of kernel versions prior to the upstream patch that addresses this logic error are vulnerable.

The CVSS score for this vulnerability is 9.4, and the EPSS score is < 1%. The vulnerability is not listed in CISA’s KEV catalog. The flaw requires manipulation of nftable set definitions and a flush operation, implying local or privileged execution is needed. While it does not provide a straightforward remote code execution path, an attacker could leverage the bug to disrupt packet filtering, leading to potential denial of service or traffic diversion. The risk therefore is high, primarily affecting systems that rely heavily on nftables for critical filtering.