CVE-2025-38162 netfilter: nft_set_pipapo: prevent overflow in lookup table allocation

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Affecting netfilter Components Announced Four new Common Vulnerabilities and Exposures (CVEs) related to netfilter components have been published. The vulnerabilities include issues with lookup table allocation, maximum map bucket size, data validation, and struct initialization, affecting various aspects of network filtering. The CVEs are CVE-2025-21959, CVE-2025-38162, CVE-2025-38201, and CVE-2024-42070. 11 sources 39