CVE-2025-39867

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nft_set_pipapo: fix null deref for empty set<br /> <br /> Blamed commit broke the check for a null scratch map:<br /> - if (unlikely(!m || !*raw_cpu_ptr(m-&gt;scratch)))<br /> + if (unlikely(!raw_cpu_ptr(m-&gt;scratch)))<br /> <br /> This should have been "if (!*raw_ ...)".<br /> Use the pattern of the avx2 version which is more readable.<br /> <br /> This can only be reproduced if avx2 support isn&amp;#39;t available.