CVE-2025-38120

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_set_pipapo_avx2: fix initial map fill If the first field doesn't cover the entire start map, then we must zero out the remainder, else we leak those bits into the next match round map. The early fix was incomplete and did only fix up the generic C implementation. A followup patch adds a test case to nft_concat_range.sh.

CVSS 3.1

5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-25)

Published

2025-07-03

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

Affected

• debian:debian_linux
• linux:linux_kernel

References

• https://git.kernel.org/stable/c/251496ce1728c9fd47bd2b20a7b21b20b9a020ca
• https://git.kernel.org/stable/c/39bab2d3517b5b50c609b4f8c66129bf619fffa0
• https://git.kernel.org/stable/c/8068e1e42b46518ce680dc6470bcd710efc3fa0a
• https://git.kernel.org/stable/c/8164d0efaf370c425dc69a1e8216940d09e7de0c
• https://git.kernel.org/stable/c/90bc7f5a244aadee4292b28098b7c98aadd4b3aa

Check your stackJSON