CVE-2026-72252

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72252", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.915Z", "datePublished": "2026-08-15T05:54:40.740Z", "dateUpdated": "2026-10-16T18:55:13.379Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:47:06.920Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: don't leak bad clone into future transaction\n\nOn memory allocation failure the cloned nft_pipapo_match can enter a bad\nstate:\n - some fields can have their lookup tables resized while others did\n not\n - bits might have been toggled\n - scratch map can be undersized which also means m->bsize_max can be\n lower than what is required\n\nThis means that the next insertion in the same batch can trigger\nout-of-bounds writes.\n\nFurthermore, a failure in the first can result in the bad clone to\nleak into the next transaction because the abort callback is never\nexecuted in this case (the upper layer saw an error and no attempt to\nallocate a transactional request was made).\n\nRecord a state for the nft_pipapo_match structure:\n- NEW (pristine clone)\n- MOD (modified clone with good state)\n- ERR (potentially bogus content)\n\nThen make it so that deletes and insertions fail when the clone\nentered ERR state.\n\nIn case the very first insert attempt results in an error, free the\nclone right away."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only via the nf_tables netlink control path (NFT_MSG_NEWSETELEM into nft_pipapo_insert); it is not triggered by remote packet handling, so attack vector is Local per kernel nftables guidance.\nAC:L - An attacker can reliably induce the needed allocation failure by crafting wide pipapo interval elements and constraining memory (e.g., memcg limits), then retrying until a partial insert leaves a corrupted clone that the next add reuses.\nPR:L - All nf_tables netlink operations require CAP_NET_ADMIN; on systems with unprivileged user namespaces this capability is obtainable by a normal local user via unshare -Urn, so privileges required are Low rather than High.\nUI:N - Exploitation requires only attacker-controlled nftables set element insertions and does not depend on any victim user action such as opening files or mounting filesystems.\nS:U - Impact is kernel heap corruption and potential privilege escalation within the same kernel security domain; it does not inherently cross VM, IOMMU, or other sandbox boundaries without separate exploitation.\nC:H - A partially updated pipapo clone leaves inconsistent lookup/mapping tables and undersized scratch buffers; subsequent inserts or lookups can perform out-of-bounds heap access that is exploitable for arbitrary kernel memory disclosure.\nI:H - The fix commit explicitly states the corrupted clone can cause out-of-bounds writes on the next insertion, enabling heap corruption that can be leveraged for arbitrary kernel writes and local privilege escalation.\nA:H - Out-of-bounds writes into kernel heap structures commonly cause kernel oops/panic or persistent instability; memory corruption from this bug can crash the system even when full exploitation is not attempted."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nft_set_pipapo.c", "net/netfilter/nft_set_pipapo.h"], "versions": [{"version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "0ab7b1802f63ca5b288ea59acb467830b83abd6b", "status": "affected", "versionType": "git"}, {"version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "cc53703f48558896295f565cd4f5e956d21b7af4", "status": "affected", "versionType": "git"}, {"version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "047e813324eac2ac60cddfb58bcdbd0144eadb09", "status": "affected", "versionType": "git"}, {"version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "610e3b73efaec3dd81a95dcda2421ad7d9795bd0", "status": "affected", "versionType": "git"}, {"version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "02b6b0e892aea582590671796fd6eff5b93ea93f", "status": "affected", "versionType": "git"}, {"version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "e74f9680e1b64872a51cc7b5bda1edaaa08aa51f", "status": "affected", "versionType": "git"}, {"version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "47e65eff50691f0a5b79d325e28d83ec1da43bcf", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nft_set_pipapo.c", "net/netfilter/nft_set_pipapo.h"], "versions": [{"version": "5.6", "status": "affected"}, {"version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.217", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.184", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.15.217"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.1.184"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0ab7b1802f63ca5b288ea59acb467830b83abd6b"}, {"url": "https://git.kernel.org/stable/c/cc53703f48558896295f565cd4f5e956d21b7af4"}, {"url": "https://git.kernel.org/stable/c/047e813324eac2ac60cddfb58bcdbd0144eadb09"}, {"url": "https://git.kernel.org/stable/c/610e3b73efaec3dd81a95dcda2421ad7d9795bd0"}, {"url": "https://git.kernel.org/stable/c/02b6b0e892aea582590671796fd6eff5b93ea93f"}, {"url": "https://git.kernel.org/stable/c/e74f9680e1b64872a51cc7b5bda1edaaa08aa51f"}, {"url": "https://git.kernel.org/stable/c/47e65eff50691f0a5b79d325e28d83ec1da43bcf"}], "title": "netfilter: nft_set_pipapo: don't leak bad clone into future transaction", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72252", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:45:15.352751Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:55:13.379Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72252", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:45:15.352751Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:45:15.997Z"}}], "cna": {"title": "netfilter: nft_set_pipapo: don't leak bad clone into future transaction", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only via the nf_tables netlink control path (NFT_MSG_NEWSETELEM into nft_pipapo_insert); it is not triggered by remote packet handling, so attack vector is Local per kernel nftables guidance.\nAC:L - An attacker can reliably induce the needed allocation failure by crafting wide pipapo interval elements and constraining memory (e.g., memcg limits), then retrying until a partial insert leaves a corrupted clone that the next add reuses.\nPR:L - All nf_tables netlink operations require CAP_NET_ADMIN; on systems with unprivileged user namespaces this capability is obtainable by a normal local user via unshare -Urn, so privileges required are Low rather than High.\nUI:N - Exploitation requires only attacker-controlled nftables set element insertions and does not depend on any victim user action such as opening files or mounting filesystems.\nS:U - Impact is kernel heap corruption and potential privilege escalation within the same kernel security domain; it does not inherently cross VM, IOMMU, or other sandbox boundaries without separate exploitation.\nC:H - A partially updated pipapo clone leaves inconsistent lookup/mapping tables and undersized scratch buffers; subsequent inserts or lookups can perform out-of-bounds heap access that is exploitable for arbitrary kernel memory disclosure.\nI:H - The fix commit explicitly states the corrupted clone can cause out-of-bounds writes on the next insertion, enabling heap corruption that can be leveraged for arbitrary kernel writes and local privilege escalation.\nA:H - Out-of-bounds writes into kernel heap structures commonly cause kernel oops/panic or persistent instability; memory corruption from this bug can crash the system even when full exploitation is not attempted."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "0ab7b1802f63ca5b288ea59acb467830b83abd6b", "versionType": "git"}, {"status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "cc53703f48558896295f565cd4f5e956d21b7af4", "versionType": "git"}, {"status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "047e813324eac2ac60cddfb58bcdbd0144eadb09", "versionType": "git"}, {"status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "610e3b73efaec3dd81a95dcda2421ad7d9795bd0", "versionType": "git"}, {"status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "02b6b0e892aea582590671796fd6eff5b93ea93f", "versionType": "git"}, {"status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "e74f9680e1b64872a51cc7b5bda1edaaa08aa51f", "versionType": "git"}, {"status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "lessThan": "47e65eff50691f0a5b79d325e28d83ec1da43bcf", "versionType": "git"}], "programFiles": ["net/netfilter/nft_set_pipapo.c", "net/netfilter/nft_set_pipapo.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"status": "unaffected", "version": "0", "lessThan": "5.6", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.217", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.184", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.148", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/netfilter/nft_set_pipapo.c", "net/netfilter/nft_set_pipapo.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/0ab7b1802f63ca5b288ea59acb467830b83abd6b"}, {"url": "https://git.kernel.org/stable/c/cc53703f48558896295f565cd4f5e956d21b7af4"}, {"url": "https://git.kernel.org/stable/c/047e813324eac2ac60cddfb58bcdbd0144eadb09"}, {"url": "https://git.kernel.org/stable/c/610e3b73efaec3dd81a95dcda2421ad7d9795bd0"}, {"url": "https://git.kernel.org/stable/c/02b6b0e892aea582590671796fd6eff5b93ea93f"}, {"url": "https://git.kernel.org/stable/c/e74f9680e1b64872a51cc7b5bda1edaaa08aa51f"}, {"url": "https://git.kernel.org/stable/c/47e65eff50691f0a5b79d325e28d83ec1da43bcf"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: don't leak bad clone into future transaction\n\nOn memory allocation failure the cloned nft_pipapo_match can enter a bad\nstate:\n - some fields can have their lookup tables resized while others did\n not\n - bits might have been toggled\n - scratch map can be undersized which also means m->bsize_max can be\n lower than what is required\n\nThis means that the next insertion in the same batch can trigger\nout-of-bounds writes.\n\nFurthermore, a failure in the first can result in the bad clone to\nleak into the next transaction because the abort callback is never\nexecuted in this case (the upper layer saw an error and no attempt to\nallocate a transactional request was made).\n\nRecord a state for the nft_pipapo_match structure:\n- NEW (pristine clone)\n- MOD (modified clone with good state)\n- ERR (potentially bogus content)\n\nThen make it so that deletes and insertions fail when the clone\nentered ERR state.\n\nIn case the very first insert attempt results in an error, free the\nclone right away."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.217", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.184", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.148", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:47:06.920Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72252", "state": "PUBLISHED", "dateUpdated": "2026-10-16T18:55:13.379Z", "dateReserved": "2026-08-09T03:40:39.915Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:54:40.740Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/nft_set_pipapo.c", "net/netfilter/nft_set_pipapo.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0ab7b1802f63ca5b288ea59acb467830b83abd6b", "status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "versionType": "git"}, {"lessThan": "cc53703f48558896295f565cd4f5e956d21b7af4", "status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "versionType": "git"}, {"lessThan": "047e813324eac2ac60cddfb58bcdbd0144eadb09", "status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "versionType": "git"}, {"lessThan": "610e3b73efaec3dd81a95dcda2421ad7d9795bd0", "status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "versionType": "git"}, {"lessThan": "02b6b0e892aea582590671796fd6eff5b93ea93f", "status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "versionType": "git"}, {"lessThan": "e74f9680e1b64872a51cc7b5bda1edaaa08aa51f", "status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "versionType": "git"}, {"lessThan": "47e65eff50691f0a5b79d325e28d83ec1da43bcf", "status": "affected", "version": "3c4287f62044a90e73a561aa05fc46e62da173da", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/nft_set_pipapo.c", "net/netfilter/nft_set_pipapo.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"lessThan": "5.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.217", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.184", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: don't leak bad clone into future transaction\n\nOn memory allocation failure the cloned nft_pipapo_match can enter a bad\nstate:\n - some fields can have their lookup tables resized while others did\n not\n - bits might have been toggled\n - scratch map can be undersized which also means m->bsize_max can be\n lower than what is required\n\nThis means that the next insertion in the same batch can trigger\nout-of-bounds writes.\n\nFurthermore, a failure in the first can result in the bad clone to\nleak into the next transaction because the abort callback is never\nexecuted in this case (the upper layer saw an error and no attempt to\nallocate a transactional request was made).\n\nRecord a state for the nft_pipapo_match structure:\n- NEW (pristine clone)\n- MOD (modified clone with good state)\n- ERR (potentially bogus content)\n\nThen make it so that deletes and insertions fail when the clone\nentered ERR state.\n\nIn case the very first insert attempt results in an error, free the\nclone right away."}], "id": "CVE-2026-72252", "lastModified": "2026-10-16T19:17:17.230", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72252", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:45:15.352751Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:21:52.600", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/02b6b0e892aea582590671796fd6eff5b93ea93f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/047e813324eac2ac60cddfb58bcdbd0144eadb09"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0ab7b1802f63ca5b288ea59acb467830b83abd6b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/47e65eff50691f0a5b79d325e28d83ec1da43bcf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/610e3b73efaec3dd81a95dcda2421ad7d9795bd0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cc53703f48558896295f565cd4f5e956d21b7af4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e74f9680e1b64872a51cc7b5bda1edaaa08aa51f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: netfilter: nft_set_pipapo: don't leak bad clone into future transaction", "id": "2516322", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516322"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in the Linux kernel. A memory allocation failure during network filter operations can lead to an inconsistent state within the `netfilter: nft_set_pipapo` module. This inconsistency can result in out-of-bounds writes, which may allow a local attacker to cause a system crash (denial of service) or potentially execute arbitrary code with elevated privileges."], "name": "CVE-2026-72252", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72252\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72252\nhttps://lore.kernel.org/linux-cve-announce/2026081553-CVE-2026-72252-ae02@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c4287f62044a90e73a561aa05fc46e62da173da,047e813324eac2ac60cddfb58bcdbd0144eadb09)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c4287f62044a90e73a561aa05fc46e62da173da,610e3b73efaec3dd81a95dcda2421ad7d9795bd0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[047e813324eac2ac60cddfb58bcdbd0144eadb09,02b6b0e892aea582590671796fd6eff5b93ea93f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[02b6b0e892aea582590671796fd6eff5b93ea93f,e74f9680e1b64872a51cc7b5bda1edaaa08aa51f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e74f9680e1b64872a51cc7b5bda1edaaa08aa51f,47e65eff50691f0a5b79d325e28d83ec1da43bcf)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.148,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T19:15:03.349900+00:00", "updated": "2026-08-17T19:00:05.384332+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-787"]}