CVE-2026-43453 netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
A stack out-of-bounds read in the Linux kernel netfilter module allows attackers to potentially disclose memory or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43453?
CVE-2026-43453 is a high-severity memory corruption vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
pipapo_drop() passes rulemap[i + 1].n to pipapo_unmap() as the to_offset argument on every iteration, including the last one where i == m->field_count - 1. This reads one element past the end of the stack-allocated rulemap array (declared as rulemap[NFT_PIPAPO_MAX_FIELDS] with NFT_PIPAPO_MAX_FIELDS == 16).
Although pipapo_unmap() returns early when is_last is true without using the to_offset value, the argument is evaluated at the call site before the function body executes, making this a genuine out-of-bounds stack read confirmed by KASAN:
BUG: KASAN: stack-out-of-bounds in pipapo_drop+0x50c/0x57c [nf_tables] Read of size 4 at addr ffff8000810e71a4
This frame has 1 object: [32, 160) 'rulemap'
The buggy address is at offset 164 -- exactly 4 bytes past the end of the rulemap array.
Pass 0 instead of rulemap[i + 1].n on the last iteration to avoid the out-of-bounds read.
Weakness: CWE-125
Which versions are affected by CVE-2026-43453?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43453?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-43453 being exploited?
There is no known exploitation of CVE-2026-43453 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43453, DEBIAN-CVE-2026-43453, GHSA-hc7j-44jc-q764, ROOT-OS-DEBIAN-11-CVE-2026-43453, ROOT-OS-UBUNTU-2204-CVE-2026-43453, ROOT-OS-UBUNTU-2404-CVE-2026-43453 and 1 more.