CVE-2025-38120

What it actually does

Incomplete zeroing of the initial map in the AVX2-accelerated nf_set_pipapo implementation allows uninitialized bits from the first field to leak into the next match round map when the field does not cover the entire start map.

Why it matters to the business

Systems processing network traffic with nftables may leak internal kernel state or memory contents, increasing risk of sensitive data exposure on widely deployed Linux kernels; high ecosystem prevalence amplifies exposure across servers and containers.

How an attack unfolds

An attacker with the ability to install nftables rules or influence packet classification triggers the pipapo AVX2 path with carefully chosen set ranges; the incomplete map fill causes kernel bits to be copied into subsequent match structures that can be observed through timing or error side channels, similar to patterns seen in related kernel privilege-escalation campaigns.

How to fix it

Upgrade the Linux kernel to version 5.15.186 or apply commit 8164d0efaf370c425dc69a1e8216940d09e7de0c; rebuild and reboot affected systems; for AlmaLinux 9 also update buildah and buildah-tests to 2:1.39.4-2.el9_6.

How to confirm the fix worked

Verify running kernel version is at least 5.15.186, confirm the commit is present in /proc/version or via package manager, and test nft_concat_range.sh to ensure the map-fill test case passes.

Typical attack path

1. Identify or gain access to a system using nftables with concat range sets on an affected kernel
2. Install or coerce creation of a set whose first field does not fully cover the start map
3. Send crafted packets that exercise the AVX2-accelerated lookup path
4. Observe leaked kernel bits through side-channel responses or follow-on memory disclosures

How to detect it

Review system logs for unusual nftables rule installations or packet processing anomalies around the time of suspected exposure; correlate with kernel oops or memory-corruption traces in dmesg; look for post-exploitation activity associated with the listed Advanced Spyware Campaign and related privilege-escalation CVEs.

What your security team should do

• Prioritize kernel upgrades on all internet-facing or multi-tenant systems before the CISA-style remediation window closes
• Audit nftables configurations for concat range sets and restrict unprivileged rule creation where possible
• Monitor EPSS trend and threat-actor activity around related kernel CVEs for increased exploitation likelihood