CVE-2025-38120

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_set_pipapo_avx2: fix initial map fill

If the first field doesn't cover the entire start map, then we must zero out the remainder, else we leak those bits into the next match round map.

The early fix was incomplete and did only fix up the generic C implementation.

A followup patch adds a test case to nft_concat_range.sh.

This vulnerability is rated as Moderate severity because exploitation requires local access and the configuration of specific concatenated range sets in nftables on systems with AVX2-capable hardware. A local user could trigger this flaw to cause incorrect rule evaluation or a kernel denial of service, but confidentiality and arbitrary code execution are not compromised. Earlier enterprise platforms such as Red Hat Enterprise Linux 8 are not affected because the vulnerable code is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.