CVE-2025-21826 (GCVE-0-2025-21826)

Vulnerability from cvelistv5 – Published: 2025-03-06 16:04 – Updated: 2026-08-05 11:54
VLAI
Title
netfilter: nf_tables: reject mismatching sum of field_len with set key length
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject mismatching sum of field_len with set key length The field length description provides the length of each separated key field in the concatenation, each field gets rounded up to 32-bits to calculate the pipapo rule width from pipapo_init(). The set key length provides the total size of the key aligned to 32-bits. Register-based arithmetics still allows for combining mismatching set key length and field length description, eg. set key length 10 and field description [ 5, 4 ] leading to pipapo width of 12.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2d4c0798a1ef8db15b3277697ac2def4eda42312 , < 6b467c8feac759f4c5c86d708beca2aa2b29584f (git)
Affected: 77be8c495a3f841e88b46508cc20d3d7d3289da3 , < 5083a7ae45003456c253e981b30a43f71230b4a3 (git)
Affected: 9cb084df01e198119de477ac691d682fb01e80f3 , < 2ac254343d3cf228ae0738b2615fedf85d000752 (git)
Affected: dc45bb00e66a33de1abb29e3d587880e1d4d9a7e , < 82e491e085719068179ff6a5466b7387cc4bbf32 (git)
Affected: 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 , < 49b7182b97bafbd5645414aff054b4a65d05823d (git)
Affected: 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 , < ab50d0eff4a939d20c37721fd9766347efcdb6f6 (git)
Affected: 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 , < 1b9335a8000fb70742f7db10af314104b6ace220 (git)
Affected: ff67e3e488090908dc015ba04d7407d8bd467f7e (git)
Affected: 5.10.209 , < 5.10.235 (semver)
Affected: 5.15.148 , < 5.15.179 (semver)
Affected: 6.1.75 , < 6.1.129 (semver)
Affected: 6.6.14 , < 6.6.76 (semver)
Affected: 6.7.2 , < 6.8 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 5.10.235 , ≤ 5.10.* (semver)
Unaffected: 5.15.179 , ≤ 5.15.* (semver)
Unaffected: 6.1.129 , ≤ 6.1.* (semver)
Unaffected: 6.6.76 , ≤ 6.6.* (semver)
Unaffected: 6.12.13 , ≤ 6.12.* (semver)
Unaffected: 6.13.2 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 TM MFP - BIOS Affected: 0 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Affected: 0 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:59:57.565Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - BIOS",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:03:59.800Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-503939.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6b467c8feac759f4c5c86d708beca2aa2b29584f",
              "status": "affected",
              "version": "2d4c0798a1ef8db15b3277697ac2def4eda42312",
              "versionType": "git"
            },
            {
              "lessThan": "5083a7ae45003456c253e981b30a43f71230b4a3",
              "status": "affected",
              "version": "77be8c495a3f841e88b46508cc20d3d7d3289da3",
              "versionType": "git"
            },
            {
              "lessThan": "2ac254343d3cf228ae0738b2615fedf85d000752",
              "status": "affected",
              "version": "9cb084df01e198119de477ac691d682fb01e80f3",
              "versionType": "git"
            },
            {
              "lessThan": "82e491e085719068179ff6a5466b7387cc4bbf32",
              "status": "affected",
              "version": "dc45bb00e66a33de1abb29e3d587880e1d4d9a7e",
              "versionType": "git"
            },
            {
              "lessThan": "49b7182b97bafbd5645414aff054b4a65d05823d",
              "status": "affected",
              "version": "3ce67e3793f48c1b9635beb9bb71116ca1e51b58",
              "versionType": "git"
            },
            {
              "lessThan": "ab50d0eff4a939d20c37721fd9766347efcdb6f6",
              "status": "affected",
              "version": "3ce67e3793f48c1b9635beb9bb71116ca1e51b58",
              "versionType": "git"
            },
            {
              "lessThan": "1b9335a8000fb70742f7db10af314104b6ace220",
              "status": "affected",
              "version": "3ce67e3793f48c1b9635beb9bb71116ca1e51b58",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ff67e3e488090908dc015ba04d7407d8bd467f7e",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.235",
              "status": "affected",
              "version": "5.10.209",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.179",
              "status": "affected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.129",
              "status": "affected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.76",
              "status": "affected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "5.10.209",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "5.15.148",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "6.1.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.76",
                  "versionStartIncluding": "6.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.13",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: reject mismatching sum of field_len with set key length\n\nThe field length description provides the length of each separated key\nfield in the concatenation, each field gets rounded up to 32-bits to\ncalculate the pipapo rule width from pipapo_init(). The set key length\nprovides the total size of the key aligned to 32-bits.\n\nRegister-based arithmetics still allows for combining mismatching set\nkey length and field length description, eg. set key length 10 and field\ndescription [ 5, 4 ] leading to pipapo width of 12."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached exclusively through nfnetlink/netlink configuration messages to the nf_tables subsystem (NFT_MSG_NEWSET / NFT_MSG_NEWSETELEM), which require local system access. Per kernel scoring guidance, netfilter/nftables netlink paths are Local.\nAC:L - Triggering is fully deterministic and entirely attacker-controlled: create an interval+concat set with any key length not a multiple of 4 (e.g. klen=10 with field description [5,4]) and add one ranged element. No race, no memory-layout luck, and pipapo is the only backend that accepts multi-field interval sets so the vulnerable code is always selected.\nPR:L - nfnetlink_rcv_msg() checks netlink_net_capable(skb, CAP_NET_ADMIN), which is satisfied against the network namespace\u0027s owning user namespace, so any unprivileged local user can obtain it with `unshare -Urn` and then create the malformed set. This is the standard unprivileged-user-namespace path used by public nftables exploits.\nUI:N - The attacker performs all steps themselves through netlink; no victim action, mount, or file open is needed.\nS:U - The out-of-bounds accesses and the corrupted pipapo state remain within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - pipapo consumes round_up(klen,4) bytes from buffers holding only klen, reading past the end of the heap-allocated element extension (key_end) and consuming uninitialized kernel stack bytes from the on-stack struct nft_set_elem. Those out-of-bounds values are baked into the set\u0027s lookup tables and can be recovered by an attacker probing match results through the packet path, yielding kernel heap/stack disclosure.\nI:H - Kernel data structures (the pipapo lookup and mapping tables) are populated from memory outside the intended key object, so set state is corrupted with out-of-bounds content and packet-matching verdicts, maps, and NAT decisions become dependent on that data. Consistent with kernel-CNA precedent for local nftables/ebtables out-of-bounds accesses, the memory-safety violation is treated as High integrity impact.\nA:H - The slab out-of-bounds read past the element extension is a KASAN-reportable memory-safety violation that panics on hardened/panic_on_warn configurations and can fault when the object abuts an unmapped region, and the corrupted range endpoints drive pipapo_expand() rule expansion from garbage. Any such kernel crash is scored High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:43.241Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6b467c8feac759f4c5c86d708beca2aa2b29584f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5083a7ae45003456c253e981b30a43f71230b4a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ac254343d3cf228ae0738b2615fedf85d000752"
        },
        {
          "url": "https://git.kernel.org/stable/c/82e491e085719068179ff6a5466b7387cc4bbf32"
        },
        {
          "url": "https://git.kernel.org/stable/c/49b7182b97bafbd5645414aff054b4a65d05823d"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab50d0eff4a939d20c37721fd9766347efcdb6f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b9335a8000fb70742f7db10af314104b6ace220"
        }
      ],
      "title": "netfilter: nf_tables: reject mismatching sum of field_len with set key length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21826",
    "datePublished": "2025-03-06T16:04:32.274Z",
    "dateReserved": "2024-12-29T08:45:45.775Z",
    "dateUpdated": "2026-08-05T11:54:43.241Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21826",
      "date": "2026-09-26",
      "epss": "0.00196",
      "percentile": "0.0839"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/nf_tables_api.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6b467c8feac759f4c5c86d708beca2aa2b29584f",
                    "status": "affected",
                    "version": "2d4c0798a1ef8db15b3277697ac2def4eda42312",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5083a7ae45003456c253e981b30a43f71230b4a3",
                    "status": "affected",
                    "version": "77be8c495a3f841e88b46508cc20d3d7d3289da3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2ac254343d3cf228ae0738b2615fedf85d000752",
                    "status": "affected",
                    "version": "9cb084df01e198119de477ac691d682fb01e80f3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "82e491e085719068179ff6a5466b7387cc4bbf32",
                    "status": "affected",
                    "version": "dc45bb00e66a33de1abb29e3d587880e1d4d9a7e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "49b7182b97bafbd5645414aff054b4a65d05823d",
                    "status": "affected",
                    "version": "3ce67e3793f48c1b9635beb9bb71116ca1e51b58",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ab50d0eff4a939d20c37721fd9766347efcdb6f6",
                    "status": "affected",
                    "version": "3ce67e3793f48c1b9635beb9bb71116ca1e51b58",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1b9335a8000fb70742f7db10af314104b6ace220",
                    "status": "affected",
                    "version": "3ce67e3793f48c1b9635beb9bb71116ca1e51b58",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "ff67e3e488090908dc015ba04d7407d8bd467f7e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.10.235",
                    "status": "affected",
                    "version": "5.10.209",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.15.179",
                    "status": "affected",
                    "version": "5.15.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.129",
                    "status": "affected",
                    "version": "6.1.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.76",
                    "status": "affected",
                    "version": "6.6.14",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.8",
                    "status": "affected",
                    "version": "6.7.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/nf_tables_api.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.8"
                  },
                  {
                    "lessThan": "6.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.235",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.179",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.129",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.76",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.13.*",
                    "status": "unaffected",
                    "version": "6.13.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.14",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          },
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC S7-1500 TM MFP - BIOS",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CEED5193-853E-4E5D-AA62-A0AFC1D0F7BF",
                    "versionEndExcluding": "5.10.235",
                    "versionStartIncluding": "5.10.209",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0752DD8C-9CDA-4643-961C-F270429E1783",
                    "versionEndExcluding": "5.15.179",
                    "versionStartIncluding": "5.15.148",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "76D27B0C-A7F0-4A0A-8A22-DC959D5AE7B3",
                    "versionEndExcluding": "6.1.129",
                    "versionStartIncluding": "6.1.75",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B6FF9F73-55C5-4A3D-9163-1BD9425AD424",
                    "versionEndExcluding": "6.6.76",
                    "versionStartIncluding": "6.6.14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C6E77346-E77B-410B-9535-E9CCBE7C4E8D",
                    "versionEndExcluding": "6.12.13",
                    "versionStartIncluding": "6.7.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6D4116B1-1BFD-4F23-BA84-169CC05FC5A3",
                    "versionEndExcluding": "6.13.2",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: reject mismatching sum of field_len with set key length\n\nThe field length description provides the length of each separated key\nfield in the concatenation, each field gets rounded up to 32-bits to\ncalculate the pipapo rule width from pipapo_init(). The set key length\nprovides the total size of the key aligned to 32-bits.\n\nRegister-based arithmetics still allows for combining mismatching set\nkey length and field length description, eg. set key length 10 and field\ndescription [ 5, 4 ] leading to pipapo width of 12."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nf_tables: rechaza la suma no coincidente de field_len con la longitud de la clave establecida La descripci\u00f3n de la longitud del campo proporciona la longitud de cada campo de clave separado en la concatenaci\u00f3n, cada campo se redondea a 32 bits para calcular el ancho de la regla pipapo desde pipapo_init(). La longitud de la clave establecida proporciona el tama\u00f1o total de la clave alineada a 32 bits. La aritm\u00e9tica basada en registros a\u00fan permite combinar la longitud de la clave establecida y la descripci\u00f3n de la longitud del campo no coincidentes, p. ej., la longitud de la clave establecida 10 y la descripci\u00f3n del campo [ 5, 4 ], lo que lleva a un ancho de pipapo de 12."
          }
        ],
        "id": "CVE-2025-21826",
        "lastModified": "2026-07-30T06:21:39.467",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-03-06T16:15:54.863",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1b9335a8000fb70742f7db10af314104b6ace220"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2ac254343d3cf228ae0738b2615fedf85d000752"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/49b7182b97bafbd5645414aff054b4a65d05823d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5083a7ae45003456c253e981b30a43f71230b4a3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6b467c8feac759f4c5c86d708beca2aa2b29584f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/82e491e085719068179ff6a5466b7387cc4bbf32"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ab50d0eff4a939d20c37721fd9766347efcdb6f6"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-503939.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-23T11:10:21+00:00",
      "cve": "CVE-2025-21826",
      "id": "CVE-2025-21826",
      "initial_release_date": "2025-03-06T00:00:00+00:00",
      "product_status:fixed": "917",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "62",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21826.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.