CVE-2025-38162 in Linux
Summary
by MITRE • 07/03/2025
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_pipapo: prevent overflow in lookup table allocation
When calculating the lookup table size, ensure the following multiplication does not overflow:
- desc->field_len[] maximum value is U8_MAX multiplied by
NFT_PIPAPO_GROUPS_PER_BYTE(f) that can be 2, worst case. - NFT_PIPAPO_BUCKETS(f->bb) is 2^8, worst case. - sizeof(unsigned long), from sizeof(*f->lt), lt in struct nft_pipapo_field.
Then, use check_mul_overflow() to multiply by bucket size and then use check_add_overflow() to the alignment for avx2 (if needed). Finally, add lt_size_check_overflow() helper and use it to consolidate this.
While at it, replace leftover allocation using the GFP_KERNEL to GFP_KERNEL_ACCOUNT for consistency, in pipapo_resize().
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/18/2026
The vulnerability CVE-2025-38162 addresses a critical integer overflow condition within the Linux kernel's netfilter subsystem, specifically in the nft_set_pipapo implementation. This flaw exists in the pipapo lookup table allocation mechanism where improper arithmetic operations could lead to memory corruption and potential privilege escalation. The issue manifests when calculating the memory requirements for lookup table allocation, where multiple multiplication operations involving field length, bucket size, and memory alignment parameters could exceed the maximum representable values for unsigned integers. The vulnerability impacts the nft_set_pipapo module which implements the pipapo set type for netfilter, a component used for efficient packet matching and filtering in network traffic control. This represents a classic case of integer overflow as classified under CWE-190, where the result of an arithmetic operation exceeds the maximum value that can be represented by the data type, leading to unpredictable behavior.
The technical flaw stems from the calculation of lookup table sizes during pipapo set operations where the multiplication of descriptor field lengths with bucket counts and memory alignment parameters could overflow. The maximum field length values can reach U8_MAX multiplied by NFT_PIPAPO_GROUPS_PER_BYTE which can be 2 in worst-case scenarios, while NFT_PIPAPO_BUCKETS can reach 2^8, creating a potential overflow condition when multiplied by sizeof(unsigned long). This type of vulnerability falls under the ATT&CK technique T1068 which involves exploiting local privilege escalation through kernel vulnerabilities, and specifically targets the kernel's memory management subsystem. The vulnerability requires careful arithmetic handling since the multiplication operations involve parameters that can reach their maximum values simultaneously, creating an environment where overflow conditions are likely to occur during normal operational use.
The operational impact of this vulnerability extends beyond simple memory corruption, as it could enable an attacker to manipulate kernel memory structures through crafted network packets or set operations. When the lookup table allocation fails due to overflow, the kernel may allocate insufficient memory, leading to memory corruption, system instability, or potentially allowing privilege escalation to kernel mode. The vulnerability affects systems running Linux kernels that utilize netfilter with pipapo set types, which are commonly found in network firewalls, packet filtering systems, and network security appliances. Attackers could exploit this by crafting malicious network traffic or set operations that trigger the vulnerable code path, potentially leading to complete system compromise. The exploitability is enhanced by the fact that this occurs during normal lookup table allocation operations, meaning any legitimate network traffic processing could potentially trigger the vulnerability, making it particularly dangerous for network-facing systems.
Mitigation strategies should focus on applying the kernel patches that implement proper overflow checking mechanisms using the check_mul_overflow() and check_add_overflow() functions as recommended in the fix. The implementation introduces a new helper function lt_size_check_overflow() to consolidate the overflow checks and ensure comprehensive protection across all allocation paths. Additionally, the patch updates allocation flags from GFP_KERNEL to GFP_KERNEL_ACCOUNT for consistency in memory accounting, which helps maintain proper kernel memory tracking and prevents potential memory accounting issues. Organizations should prioritize immediate patching of affected systems, particularly those running network filtering or firewall services that utilize netfilter with pipapo set types. The fix aligns with security best practices for kernel development and follows the principle of least privilege in memory allocation. System administrators should monitor for any unusual system behavior or performance degradation that might indicate exploitation attempts, and implement network segmentation to limit potential attack surfaces. This vulnerability demonstrates the importance of proper integer overflow protection in kernel space operations and reinforces the need for rigorous input validation in security-critical code paths.