Linux Kernel Netfilter Vulnerability in AVX2 Matching Functions

CVE-2026-43114

What is CVE-2026-43114?

A logic error in the Linux kernel's AVX2 matching functions for netfilter could lead to incorrect behavior during the reinsertion of elements into the data structure. Specifically, when handling a flushed set, the system may mistakenly return a previously valid entry that should not have matched due to its marked invalidity. This occurs due to improper handling of the last field during the matching process, leading to the unnecessary continuation of data processing that fails to account for all elements accurately. As a result, this vulnerability can allow for potential inconsistencies in network packet filtering.

References