When a memory allocation fails while cloning an nft_pipapo_match structure, the clone can end up in an inconsistent state where internal lookup tables are resized unevenly, bits are incorrectly toggled, and the scratch map is undersized. The next insertion in the same transaction can then write past the bounds of its memory buffers, corrupting kernel memory and potentially enabling escalation or system crash.

All versions of the Linux kernel that do not yet include the commit referenced in the advisory are affected. The vulnerability originates in the netfilter nft_set_pipapo subsystem of the kernel.

With a CVSS score of 7.8, this vulnerability is considered high. The EPSS score of <1% indicates it is unlikely to be actively exploited in the wild, and it is not listed in CISA KEV. The nature of the flaw—a kernel out‑of‑bounds write due to an unhandled allocation failure—means that a local or privileged attacker could corrupt kernel memory, potentially leading to privilege escalation or a system crash. Based on the description, it is inferred that the attacker would need local or privileged access to trigger the vulnerability, and the likely attack vector involves interacting with the netfilter nft_set_pipapo subsystem without requiring network‑level access. Because the EPSS is low, immediate patching remains the most effective countermeasure.