CVE-2025-38201 netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Affecting netfilter Components Announced Four new Common Vulnerabilities and Exposures (CVEs) related to netfilter components have been published. The vulnerabilities include issues with lookup table allocation, maximum map bucket size, data validation, and struct initialization, affecting various aspects of network filtering. The CVEs are CVE-2025-21959, CVE-2025-38162, CVE-2025-38201, and CVE-2024-42070. 11 sources 39