CVE-2026-43453

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43453", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.010Z", "datePublished": "2026-05-08T14:22:18.087Z", "dateUpdated": "2026-11-06T15:42:55.723Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:24:52.944Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()\n\npipapo_drop() passes rulemap[i + 1].n to pipapo_unmap() as the\nto_offset argument on every iteration, including the last one where\ni == m->field_count - 1. This reads one element past the end of the\nstack-allocated rulemap array (declared as rulemap[NFT_PIPAPO_MAX_FIELDS]\nwith NFT_PIPAPO_MAX_FIELDS == 16).\n\nAlthough pipapo_unmap() returns early when is_last is true without\nusing the to_offset value, the argument is evaluated at the call site\nbefore the function body executes, making this a genuine out-of-bounds\nstack read confirmed by KASAN:\n\n BUG: KASAN: stack-out-of-bounds in pipapo_drop+0x50c/0x57c [nf_tables]\n Read of size 4 at addr ffff8000810e71a4\n\n This frame has 1 object:\n [32, 160) 'rulemap'\n\n The buggy address is at offset 164 -- exactly 4 bytes past the end\n of the rulemap array.\n\nPass 0 instead of rulemap[i + 1].n on the last iteration to avoid\nthe out-of-bounds read."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nft_set_pipapo.c"], "versions": [{"version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "1957e793196e7f8557374fd4eda53abcbb42e1c0", "status": "affected", "versionType": "git"}, {"version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "57fb87ca095d5127cd7a27583b8ec43dcf7c9e9e", "status": "affected", "versionType": "git"}, {"version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "60c1d18781e37bfb96290b86510eb01c5fa24d75", "status": "affected", "versionType": "git"}, {"version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "0a55d62cdb628923d8a21724374a70c76ac7d19d", "status": "affected", "versionType": "git"}, {"version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "dfbdac719198778b581bc0dd055df2542edb8c62", "status": "affected", "versionType": "git"}, {"version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "e047f6fbb975f685d6c9fcef95b3b7787a79b46d", "status": "affected", "versionType": "git"}, {"version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "324b749aa5b2d516ccfab933df9d3f56e7807f5f", "status": "affected", "versionType": "git"}, {"version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "d6d8cd2db236a9dd13dbc2d05843b3445cc964b5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nft_set_pipapo.c"], "versions": [{"version": "5.6", "status": "affected"}, {"version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.167", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.19", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.9", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.1.167"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.12.78"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.18.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.19.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1957e793196e7f8557374fd4eda53abcbb42e1c0"}, {"url": "https://git.kernel.org/stable/c/57fb87ca095d5127cd7a27583b8ec43dcf7c9e9e"}, {"url": "https://git.kernel.org/stable/c/60c1d18781e37bfb96290b86510eb01c5fa24d75"}, {"url": "https://git.kernel.org/stable/c/0a55d62cdb628923d8a21724374a70c76ac7d19d"}, {"url": "https://git.kernel.org/stable/c/dfbdac719198778b581bc0dd055df2542edb8c62"}, {"url": "https://git.kernel.org/stable/c/e047f6fbb975f685d6c9fcef95b3b7787a79b46d"}, {"url": "https://git.kernel.org/stable/c/324b749aa5b2d516ccfab933df9d3f56e7807f5f"}, {"url": "https://git.kernel.org/stable/c/d6d8cd2db236a9dd13dbc2d05843b3445cc964b5"}], "title": "netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43453", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:39:22.846644Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:42:55.723Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43453", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:39:22.846644Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:39:24.086Z"}}], "cna": {"title": "netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "1957e793196e7f8557374fd4eda53abcbb42e1c0", "versionType": "git"}, {"status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "57fb87ca095d5127cd7a27583b8ec43dcf7c9e9e", "versionType": "git"}, {"status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "60c1d18781e37bfb96290b86510eb01c5fa24d75", "versionType": "git"}, {"status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "0a55d62cdb628923d8a21724374a70c76ac7d19d", "versionType": "git"}, {"status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "dfbdac719198778b581bc0dd055df2542edb8c62", "versionType": "git"}, {"status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "e047f6fbb975f685d6c9fcef95b3b7787a79b46d", "versionType": "git"}, {"status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "324b749aa5b2d516ccfab933df9d3f56e7807f5f", "versionType": "git"}, {"status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "d6d8cd2db236a9dd13dbc2d05843b3445cc964b5", "versionType": "git"}], "programFiles": ["net/netfilter/nft_set_pipapo.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"status": "unaffected", "version": "0", "lessThan": "5.6", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.253", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.203", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.167", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.130", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.78", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.19", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.9", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/netfilter/nft_set_pipapo.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/1957e793196e7f8557374fd4eda53abcbb42e1c0"}, {"url": "https://git.kernel.org/stable/c/57fb87ca095d5127cd7a27583b8ec43dcf7c9e9e"}, {"url": "https://git.kernel.org/stable/c/60c1d18781e37bfb96290b86510eb01c5fa24d75"}, {"url": "https://git.kernel.org/stable/c/0a55d62cdb628923d8a21724374a70c76ac7d19d"}, {"url": "https://git.kernel.org/stable/c/dfbdac719198778b581bc0dd055df2542edb8c62"}, {"url": "https://git.kernel.org/stable/c/e047f6fbb975f685d6c9fcef95b3b7787a79b46d"}, {"url": "https://git.kernel.org/stable/c/324b749aa5b2d516ccfab933df9d3f56e7807f5f"}, {"url": "https://git.kernel.org/stable/c/d6d8cd2db236a9dd13dbc2d05843b3445cc964b5"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()\n\npipapo_drop() passes rulemap[i + 1].n to pipapo_unmap() as the\nto_offset argument on every iteration, including the last one where\ni == m->field_count - 1. This reads one element past the end of the\nstack-allocated rulemap array (declared as rulemap[NFT_PIPAPO_MAX_FIELDS]\nwith NFT_PIPAPO_MAX_FIELDS == 16).\n\nAlthough pipapo_unmap() returns early when is_last is true without\nusing the to_offset value, the argument is evaluated at the call site\nbefore the function body executes, making this a genuine out-of-bounds\nstack read confirmed by KASAN:\n\n BUG: KASAN: stack-out-of-bounds in pipapo_drop+0x50c/0x57c [nf_tables]\n Read of size 4 at addr ffff8000810e71a4\n\n This frame has 1 object:\n [32, 160) 'rulemap'\n\n The buggy address is at offset 164 -- exactly 4 bytes past the end\n of the rulemap array.\n\nPass 0 instead of rulemap[i + 1].n on the last iteration to avoid\nthe out-of-bounds read."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.253", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.167", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.130", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.78", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.19", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.9", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "5.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:24:52.944Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43453", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:42:55.723Z", "dateReserved": "2026-05-01T14:12:56.010Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-08T14:22:18.087Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/nft_set_pipapo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1957e793196e7f8557374fd4eda53abcbb42e1c0", "status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "versionType": "git"}, {"lessThan": "57fb87ca095d5127cd7a27583b8ec43dcf7c9e9e", "status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "versionType": "git"}, {"lessThan": "60c1d18781e37bfb96290b86510eb01c5fa24d75", "status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "versionType": "git"}, {"lessThan": "0a55d62cdb628923d8a21724374a70c76ac7d19d", "status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "versionType": "git"}, {"lessThan": "dfbdac719198778b581bc0dd055df2542edb8c62", "status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "versionType": "git"}, {"lessThan": "e047f6fbb975f685d6c9fcef95b3b7787a79b46d", "status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "versionType": "git"}, {"lessThan": "324b749aa5b2d516ccfab933df9d3f56e7807f5f", "status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "versionType": "git"}, {"lessThan": "d6d8cd2db236a9dd13dbc2d05843b3445cc964b5", "status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/nft_set_pipapo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"lessThan": "5.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.253", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.203", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.167", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.130", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.78", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.19", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A46EE847-2B8F-4145-AB46-8D057B48AFC9", "versionEndExcluding": "5.10.253", "versionStartIncluding": "5.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2EDC6BAF-B710-4E26-B6AA-D68922EE7B43", "versionEndExcluding": "6.1.167", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267", "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "28D591F5-B196-4CC9-905C-DC80F116E7A8", "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D394AC60-6F28-435F-872A-CCDF384B8331", "versionEndExcluding": "6.18.19", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9", "versionEndExcluding": "6.19.9", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()\n\npipapo_drop() passes rulemap[i + 1].n to pipapo_unmap() as the\nto_offset argument on every iteration, including the last one where\ni == m->field_count - 1. This reads one element past the end of the\nstack-allocated rulemap array (declared as rulemap[NFT_PIPAPO_MAX_FIELDS]\nwith NFT_PIPAPO_MAX_FIELDS == 16).\n\nAlthough pipapo_unmap() returns early when is_last is true without\nusing the to_offset value, the argument is evaluated at the call site\nbefore the function body executes, making this a genuine out-of-bounds\nstack read confirmed by KASAN:\n\n BUG: KASAN: stack-out-of-bounds in pipapo_drop+0x50c/0x57c [nf_tables]\n Read of size 4 at addr ffff8000810e71a4\n\n This frame has 1 object:\n [32, 160) 'rulemap'\n\n The buggy address is at offset 164 -- exactly 4 bytes past the end\n of the rulemap array.\n\nPass 0 instead of rulemap[i + 1].n on the last iteration to avoid\nthe out-of-bounds read."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: nft_set_pipapo: correcci\u00f3n de lectura fuera de l\u00edmites de la pila en pipapo_drop()\n\npipapo_drop() pasa rulemap[i + 1].n a pipapo_unmap() como el argumento to_offset en cada iteraci\u00f3n, incluyendo la \u00faltima donde i == m -> field_count - 1. Esto lee un elemento m\u00e1s all\u00e1 del final del array rulemap asignado en la pila (declarado como rulemap[NFT_PIPAPO_MAX_FIELDS] con NFT_PIPAPO_MAX_FIELDS == 16).\n\nAunque pipapo_unmap() retorna anticipadamente cuando is_last es verdadero sin usar el valor de to_offset, el argumento es evaluado en el sitio de la llamada antes de que se ejecute el cuerpo de la funci\u00f3n, haciendo de esto una lectura genuina fuera de l\u00edmites de la pila confirmada por KASAN:\n\n BUG: KASAN: lectura fuera de l\u00edmites de la pila en pipapo_drop+0x50c/0x57c [nf_tables]\n Lectura de tama\u00f1o 4 en la direcci\u00f3n ffff8000810e71a4\n\n Este marco tiene 1 objeto:\n [32, 160) \u2019rulemap\u2019\n\n La direcci\u00f3n err\u00f3nea est\u00e1 en el desplazamiento 164 -- exactamente 4 bytes despu\u00e9s del final\n del array rulemap.\n\nPasar 0 en lugar de rulemap[i + 1].n en la \u00faltima iteraci\u00f3n para evitar la lectura fuera de l\u00edmites."}], "id": "CVE-2026-43453", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43453", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T15:39:22.846644Z", "version": "2.0.3"}}]}, "published": "2026-05-08T15:16:58.027", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0a55d62cdb628923d8a21724374a70c76ac7d19d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1957e793196e7f8557374fd4eda53abcbb42e1c0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/324b749aa5b2d516ccfab933df9d3f56e7807f5f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/57fb87ca095d5127cd7a27583b8ec43dcf7c9e9e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/60c1d18781e37bfb96290b86510eb01c5fa24d75"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d6d8cd2db236a9dd13dbc2d05843b3445cc964b5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dfbdac719198778b581bc0dd055df2542edb8c62"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e047f6fbb975f685d6c9fcef95b3b7787a79b46d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's netfilter component, specifically within the `nft_set_pipapo` module. The `pipapo_drop()` function performs a stack out-of-bounds read. This occurs when an argument is evaluated at the call site before the function body executes, leading to a read beyond the allocated `rulemap` array. This could potentially lead to information disclosure or system instability."], "name": "CVE-2026-43453", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43453\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43453\nhttps://lore.kernel.org/linux-cve-announce/2026050858-CVE-2026-43453-fbba@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c4287f62044a90e73a561aa05fc46e62da173da,1957e793196e7f8557374fd4eda53abcbb42e1c0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c4287f62044a90e73a561aa05fc46e62da173da,57fb87ca095d5127cd7a27583b8ec43dcf7c9e9e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c4287f62044a90e73a561aa05fc46e62da173da,60c1d18781e37bfb96290b86510eb01c5fa24d75)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c4287f62044a90e73a561aa05fc46e62da173da,0a55d62cdb628923d8a21724374a70c76ac7d19d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c4287f62044a90e73a561aa05fc46e62da173da,dfbdac719198778b581bc0dd055df2542edb8c62)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c4287f62044a90e73a561aa05fc46e62da173da,e047f6fbb975f685d6c9fcef95b3b7787a79b46d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c4287f62044a90e73a561aa05fc46e62da173da,324b749aa5b2d516ccfab933df9d3f56e7807f5f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c4287f62044a90e73a561aa05fc46e62da173da,d6d8cd2db236a9dd13dbc2d05843b3445cc964b5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.253,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.203,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.167,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.130,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.78,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.19,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.9,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-08T17:00:16.207427+00:00", "updated": "2026-05-21T18:45:17.080379+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}