A stack out-of-bounds read occurs in the nftables pipapo_drop() function when the last rule map element is processed. The function reads a field past the end of the stack-allocated array, leading to a KASAN-detected memory access violation. The read can expose kernel memory contents to the calling context, potentially leaking sensitive data. This weakness is an example of improper restrictions on buffer bounds and leads to information exposure.

All Linux kernel instances running the affected nft_set_pipapo implementation are susceptible. The vulnerability applies to every build of the kernel that has not yet incorporated the patch referenced in the description. It is vendor-agnostic within the Linux ecosystem.

The CVSS score is 5.5, indicating moderate severity. EPSS is < 1%, so the likelihood of exploitation is considered very low but not zero. The vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is local manipulation of nftables rules, which requires elevated privileges to create or drop rules. While the vulnerability does not allow arbitrary code execution, it does enable a stack out-of-bounds read that can expose kernel memory contents, potentially leaking sensitive data. The risk is moderate, driven by the possibility of information leakage and the lack of broader exploitation guidance.