CVE-2026-43453

Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.10 through 6.19

Description A stack out-of-bounds read exists in the nftables pipapo set backend within the pipapo drop() function. The issue occurs because the function passes rulemap[i + 1].n to pipapo unmap() as the to offset argument during every iteration. On the final iteration, where i equals m->field count - 1, the code reads one element beyond the end of the stack-allocated rulemap array (which has a maximum size of 16 fields). Although pipapo unmap() is designed to return early when the is last flag is true without using the to offset value, C evaluates all arguments at the call site before the function executes, resulting in an out-of-bounds read. This can be triggered during normal operations such as element expiration or deletion via the kernel garbage collector.

Recommendations Update Linux kernel to a version later than 6.19. As a temporary workaround, restrict the use of pipapo sets with 16 concatenated fields and timeouts to minimize the risk of triggering the out-of-bounds read.