{"api_version":"1","generated_at":"2026-08-23T21:52:48+00:00","cve":"CVE-2026-72252","urls":{"html":"https://cve.report/CVE-2026-72252","api":"https://cve.report/api/cve/CVE-2026-72252.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72252","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72252"},"summary":{"title":"netfilter: nft_set_pipapo: don't leak bad clone into future transaction","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: don't leak bad clone into future transaction\n\nOn memory allocation failure the cloned nft_pipapo_match can enter a bad\nstate:\n - some fields can have their lookup tables resized while others did\n   not\n - bits might have been toggled\n - scratch map can be undersized which also means m->bsize_max can be\n   lower than what is required\n\nThis means that the next insertion in the same batch can trigger\nout-of-bounds writes.\n\nFurthermore, a failure in the first can result in the bad clone to\nleak into the next transaction because the abort callback is never\nexecuted in this case (the upper layer saw an error and no attempt to\nallocate a transactional request was made).\n\nRecord a state for the nft_pipapo_match structure:\n- NEW (pristine clone)\n- MOD (modified clone with good state)\n- ERR (potentially bogus content)\n\nThen make it so that deletes and insertions fail when the clone\nentered ERR state.\n\nIn case the very first insert attempt results in an error, free the\nclone right away.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:21:52","updated_at":"2026-08-23 13:16:42"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/610e3b73efaec3dd81a95dcda2421ad7d9795bd0","name":"https://git.kernel.org/stable/c/610e3b73efaec3dd81a95dcda2421ad7d9795bd0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/047e813324eac2ac60cddfb58bcdbd0144eadb09","name":"https://git.kernel.org/stable/c/047e813324eac2ac60cddfb58bcdbd0144eadb09","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e74f9680e1b64872a51cc7b5bda1edaaa08aa51f","name":"https://git.kernel.org/stable/c/e74f9680e1b64872a51cc7b5bda1edaaa08aa51f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/47e65eff50691f0a5b79d325e28d83ec1da43bcf","name":"https://git.kernel.org/stable/c/47e65eff50691f0a5b79d325e28d83ec1da43bcf","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/cc53703f48558896295f565cd4f5e956d21b7af4","name":"https://git.kernel.org/stable/c/cc53703f48558896295f565cd4f5e956d21b7af4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/02b6b0e892aea582590671796fd6eff5b93ea93f","name":"https://git.kernel.org/stable/c/02b6b0e892aea582590671796fd6eff5b93ea93f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/0ab7b1802f63ca5b288ea59acb467830b83abd6b","name":"https://git.kernel.org/stable/c/0ab7b1802f63ca5b288ea59acb467830b83abd6b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72252","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72252","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3c4287f62044a90e73a561aa05fc46e62da173da 0ab7b1802f63ca5b288ea59acb467830b83abd6b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3c4287f62044a90e73a561aa05fc46e62da173da cc53703f48558896295f565cd4f5e956d21b7af4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3c4287f62044a90e73a561aa05fc46e62da173da 047e813324eac2ac60cddfb58bcdbd0144eadb09 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3c4287f62044a90e73a561aa05fc46e62da173da 610e3b73efaec3dd81a95dcda2421ad7d9795bd0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3c4287f62044a90e73a561aa05fc46e62da173da 02b6b0e892aea582590671796fd6eff5b93ea93f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3c4287f62044a90e73a561aa05fc46e62da173da e74f9680e1b64872a51cc7b5bda1edaaa08aa51f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3c4287f62044a90e73a561aa05fc46e62da173da 47e65eff50691f0a5b79d325e28d83ec1da43bcf git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.6","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.6 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.217 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.184 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.148 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.97 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.40 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"72252","cve":"CVE-2026-72252","epss":"0.001630000","percentile":"0.060320000","score_date":"2026-08-17","updated_at":"2026-08-18 00:11:47"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netfilter/nft_set_pipapo.c","net/netfilter/nft_set_pipapo.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0ab7b1802f63ca5b288ea59acb467830b83abd6b","status":"affected","version":"3c4287f62044a90e73a561aa05fc46e62da173da","versionType":"git"},{"lessThan":"cc53703f48558896295f565cd4f5e956d21b7af4","status":"affected","version":"3c4287f62044a90e73a561aa05fc46e62da173da","versionType":"git"},{"lessThan":"047e813324eac2ac60cddfb58bcdbd0144eadb09","status":"affected","version":"3c4287f62044a90e73a561aa05fc46e62da173da","versionType":"git"},{"lessThan":"610e3b73efaec3dd81a95dcda2421ad7d9795bd0","status":"affected","version":"3c4287f62044a90e73a561aa05fc46e62da173da","versionType":"git"},{"lessThan":"02b6b0e892aea582590671796fd6eff5b93ea93f","status":"affected","version":"3c4287f62044a90e73a561aa05fc46e62da173da","versionType":"git"},{"lessThan":"e74f9680e1b64872a51cc7b5bda1edaaa08aa51f","status":"affected","version":"3c4287f62044a90e73a561aa05fc46e62da173da","versionType":"git"},{"lessThan":"47e65eff50691f0a5b79d325e28d83ec1da43bcf","status":"affected","version":"3c4287f62044a90e73a561aa05fc46e62da173da","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/netfilter/nft_set_pipapo.c","net/netfilter/nft_set_pipapo.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.6"},{"lessThan":"5.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.217","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.184","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.217","versionStartIncluding":"5.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.184","versionStartIncluding":"5.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.148","versionStartIncluding":"5.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.97","versionStartIncluding":"5.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.40","versionStartIncluding":"5.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"5.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"5.6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: don't leak bad clone into future transaction\n\nOn memory allocation failure the cloned nft_pipapo_match can enter a bad\nstate:\n - some fields can have their lookup tables resized while others did\n   not\n - bits might have been toggled\n - scratch map can be undersized which also means m->bsize_max can be\n   lower than what is required\n\nThis means that the next insertion in the same batch can trigger\nout-of-bounds writes.\n\nFurthermore, a failure in the first can result in the bad clone to\nleak into the next transaction because the abort callback is never\nexecuted in this case (the upper layer saw an error and no attempt to\nallocate a transactional request was made).\n\nRecord a state for the nft_pipapo_match structure:\n- NEW (pristine clone)\n- MOD (modified clone with good state)\n- ERR (potentially bogus content)\n\nThen make it so that deletes and insertions fail when the clone\nentered ERR state.\n\nIn case the very first insert attempt results in an error, free the\nclone right away."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only via the nf_tables netlink control path (NFT_MSG_NEWSETELEM into nft_pipapo_insert); it is not triggered by remote packet handling, so attack vector is Local per kernel nftables guidance.\nAC:L - An attacker can reliably induce the needed allocation failure by crafting wide pipapo interval elements and constraining memory (e.g., memcg limits), then retrying until a partial insert leaves a corrupted clone that the next add reuses.\nPR:L - All nf_tables netlink operations require CAP_NET_ADMIN; on systems with unprivileged user namespaces this capability is obtainable by a normal local user via unshare -Urn, so privileges required are Low rather than High.\nUI:N - Exploitation requires only attacker-controlled nftables set element insertions and does not depend on any victim user action such as opening files or mounting filesystems.\nS:U - Impact is kernel heap corruption and potential privilege escalation within the same kernel security domain; it does not inherently cross VM, IOMMU, or other sandbox boundaries without separate exploitation.\nC:H - A partially updated pipapo clone leaves inconsistent lookup/mapping tables and undersized scratch buffers; subsequent inserts or lookups can perform out-of-bounds heap access that is exploitable for arbitrary kernel memory disclosure.\nI:H - The fix commit explicitly states the corrupted clone can cause out-of-bounds writes on the next insertion, enabling heap corruption that can be leveraged for arbitrary kernel writes and local privilege escalation.\nA:H - Out-of-bounds writes into kernel heap structures commonly cause kernel oops/panic or persistent instability; memory corruption from this bug can crash the system even when full exploitation is not attempted."}]}],"providerMetadata":{"dateUpdated":"2026-08-23T12:47:06.920Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/0ab7b1802f63ca5b288ea59acb467830b83abd6b"},{"url":"https://git.kernel.org/stable/c/cc53703f48558896295f565cd4f5e956d21b7af4"},{"url":"https://git.kernel.org/stable/c/047e813324eac2ac60cddfb58bcdbd0144eadb09"},{"url":"https://git.kernel.org/stable/c/610e3b73efaec3dd81a95dcda2421ad7d9795bd0"},{"url":"https://git.kernel.org/stable/c/02b6b0e892aea582590671796fd6eff5b93ea93f"},{"url":"https://git.kernel.org/stable/c/e74f9680e1b64872a51cc7b5bda1edaaa08aa51f"},{"url":"https://git.kernel.org/stable/c/47e65eff50691f0a5b79d325e28d83ec1da43bcf"}],"title":"netfilter: nft_set_pipapo: don't leak bad clone into future transaction","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-72252","datePublished":"2026-08-15T05:54:40.740Z","dateReserved":"2026-08-09T03:40:39.915Z","dateUpdated":"2026-08-23T12:47:06.920Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:21:52","lastModifiedDate":"2026-08-23 13:16:42","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72252","Ordinal":"1","Title":"netfilter: nft_set_pipapo: don't leak bad clone into future tran","CVE":"CVE-2026-72252","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72252","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: don't leak bad clone into future transaction\n\nOn memory allocation failure the cloned nft_pipapo_match can enter a bad\nstate:\n - some fields can have their lookup tables resized while others did\n   not\n - bits might have been toggled\n - scratch map can be undersized which also means m->bsize_max can be\n   lower than what is required\n\nThis means that the next insertion in the same batch can trigger\nout-of-bounds writes.\n\nFurthermore, a failure in the first can result in the bad clone to\nleak into the next transaction because the abort callback is never\nexecuted in this case (the upper layer saw an error and no attempt to\nallocate a transactional request was made).\n\nRecord a state for the nft_pipapo_match structure:\n- NEW (pristine clone)\n- MOD (modified clone with good state)\n- ERR (potentially bogus content)\n\nThen make it so that deletes and insertions fail when the clone\nentered ERR state.\n\nIn case the very first insert attempt results in an error, free the\nclone right away.","Type":"Description","Title":"netfilter: nft_set_pipapo: don't leak bad clone into future tran"}]}}}