{"id":"CVE-2025-21826","state":"PUBLISHED","title":"netfilter: nf_tables: reject mismatching sum of field_len with set key length","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: reject mismatching sum of field_len with set key length\n\nThe field length description provides the length of each separated key\nfield in the concatenation, each field gets rounded up to 32-bits to\ncalculate the pipapo rule width from pipapo_init(). The set key length\nprovides the total size of the key aligned to 32-bits.\n\nRegister-based arithmetics still allows for combining mismatching set\nkey length and field length description, eg. set key length 10 and field\ndescription [ 5, 4 ] leading to pipapo width of 12.","publishedAt":"2025-03-06T16:04:32.274Z","updatedAt":"2026-10-15T01:04:36.090Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2d4c0798a1ef8db15b3277697ac2def4eda42312","status":"affected","lessThan":"6b467c8feac759f4c5c86d708beca2aa2b29584f","versionType":"git"},{"version":"77be8c495a3f841e88b46508cc20d3d7d3289da3","status":"affected","lessThan":"5083a7ae45003456c253e981b30a43f71230b4a3","versionType":"git"},{"version":"9cb084df01e198119de477ac691d682fb01e80f3","status":"affected","lessThan":"2ac254343d3cf228ae0738b2615fedf85d000752","versionType":"git"},{"version":"dc45bb00e66a33de1abb29e3d587880e1d4d9a7e","status":"affected","lessThan":"82e491e085719068179ff6a5466b7387cc4bbf32","versionType":"git"},{"version":"3ce67e3793f48c1b9635beb9bb71116ca1e51b58","status":"affected","lessThan":"49b7182b97bafbd5645414aff054b4a65d05823d","versionType":"git"},{"version":"3ce67e3793f48c1b9635beb9bb71116ca1e51b58","status":"affected","lessThan":"ab50d0eff4a939d20c37721fd9766347efcdb6f6","versionType":"git"},{"version":"3ce67e3793f48c1b9635beb9bb71116ca1e51b58","status":"affected","lessThan":"1b9335a8000fb70742f7db10af314104b6ace220","versionType":"git"},{"version":"ff67e3e488090908dc015ba04d7407d8bd467f7e","status":"affected","versionType":"git"},{"version":"5.10.209","status":"affected","lessThan":"5.10.235","versionType":"semver"},{"version":"5.15.148","status":"affected","lessThan":"5.15.179","versionType":"semver"},{"version":"6.1.75","status":"affected","lessThan":"6.1.129","versionType":"semver"},{"version":"6.6.14","status":"affected","lessThan":"6.6.76","versionType":"semver"},{"version":"6.7.2","status":"affected","lessThan":"6.8","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_tables_api.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.8","versionType":"semver"},{"version":"5.10.235","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.179","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.129","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.76","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.13","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13.2","status":"unaffected","lessThanOrEqual":"6.13.*","versionType":"semver"},{"version":"6.14","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_tables_api.c"]}],"references":["https://git.kernel.org/stable/c/6b467c8feac759f4c5c86d708beca2aa2b29584f","https://git.kernel.org/stable/c/5083a7ae45003456c253e981b30a43f71230b4a3","https://git.kernel.org/stable/c/2ac254343d3cf228ae0738b2615fedf85d000752","https://git.kernel.org/stable/c/82e491e085719068179ff6a5466b7387cc4bbf32","https://git.kernel.org/stable/c/49b7182b97bafbd5645414aff054b4a65d05823d","https://git.kernel.org/stable/c/ab50d0eff4a939d20c37721fd9766347efcdb6f6","https://git.kernel.org/stable/c/1b9335a8000fb70742f7db10af314104b6ace220","https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-503939.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/21xxx/CVE-2025-21826.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-21826","state":"PUBLISHED","datePublished":"2025-03-06T16:04:32.274Z","dateUpdated":"2026-10-15T01:04:36.090Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-12-29T08:45:45.775Z"},"containers":{"cna":{"title":"netfilter: nf_tables: reject mismatching sum of field_len with set key length","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: reject mismatching sum of field_len with set key length\n\nThe field length description provides the length of each separated key\nfield in the concatenation, each field gets rounded up to 32-bits to\ncalculate the pipapo rule width from pipapo_init(). The set key length\nprovides the total size of the key aligned to 32-bits.\n\nRegister-based arithmetics still allows for combining mismatching set\nkey length and field length description, eg. set key length 10 and field\ndescription [ 5, 4 ] leading to pipapo width of 12."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2d4c0798a1ef8db15b3277697ac2def4eda42312","status":"affected","lessThan":"6b467c8feac759f4c5c86d708beca2aa2b29584f","versionType":"git"},{"version":"77be8c495a3f841e88b46508cc20d3d7d3289da3","status":"affected","lessThan":"5083a7ae45003456c253e981b30a43f71230b4a3","versionType":"git"},{"version":"9cb084df01e198119de477ac691d682fb01e80f3","status":"affected","lessThan":"2ac254343d3cf228ae0738b2615fedf85d000752","versionType":"git"},{"version":"dc45bb00e66a33de1abb29e3d587880e1d4d9a7e","status":"affected","lessThan":"82e491e085719068179ff6a5466b7387cc4bbf32","versionType":"git"},{"version":"3ce67e3793f48c1b9635beb9bb71116ca1e51b58","status":"affected","lessThan":"49b7182b97bafbd5645414aff054b4a65d05823d","versionType":"git"},{"version":"3ce67e3793f48c1b9635beb9bb71116ca1e51b58","status":"affected","lessThan":"ab50d0eff4a939d20c37721fd9766347efcdb6f6","versionType":"git"},{"version":"3ce67e3793f48c1b9635beb9bb71116ca1e51b58","status":"affected","lessThan":"1b9335a8000fb70742f7db10af314104b6ace220","versionType":"git"},{"version":"ff67e3e488090908dc015ba04d7407d8bd467f7e","status":"affected","versionType":"git"},{"version":"5.10.209","status":"affected","lessThan":"5.10.235","versionType":"semver"},{"version":"5.15.148","status":"affected","lessThan":"5.15.179","versionType":"semver"},{"version":"6.1.75","status":"affected","lessThan":"6.1.129","versionType":"semver"},{"version":"6.6.14","status":"affected","lessThan":"6.6.76","versionType":"semver"},{"version":"6.7.2","status":"affected","lessThan":"6.8","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_tables_api.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.8","versionType":"semver"},{"version":"5.10.235","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.179","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.129","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.76","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.13","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13.2","status":"unaffected","lessThanOrEqual":"6.13.*","versionType":"semver"},{"version":"6.14","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_tables_api.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/6b467c8feac759f4c5c86d708beca2aa2b29584f"},{"url":"https://git.kernel.org/stable/c/5083a7ae45003456c253e981b30a43f71230b4a3"},{"url":"https://git.kernel.org/stable/c/2ac254343d3cf228ae0738b2615fedf85d000752"},{"url":"https://git.kernel.org/stable/c/82e491e085719068179ff6a5466b7387cc4bbf32"},{"url":"https://git.kernel.org/stable/c/49b7182b97bafbd5645414aff054b4a65d05823d"},{"url":"https://git.kernel.org/stable/c/ab50d0eff4a939d20c37721fd9766347efcdb6f6"},{"url":"https://git.kernel.org/stable/c/1b9335a8000fb70742f7db10af314104b6ace220"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached exclusively through nfnetlink/netlink configuration messages to the nf_tables subsystem (NFT_MSG_NEWSET / NFT_MSG_NEWSETELEM), which require local system access. Per kernel scoring guidance, netfilter/nftables netlink paths are Local.\nAC:L - Triggering is fully deterministic and entirely attacker-controlled: create an interval+concat set with any key length not a multiple of 4 (e.g. klen=10 with field description [5,4]) and add one ranged element. No race, no memory-layout luck, and pipapo is the only backend that accepts multi-field interval sets so the vulnerable code is always selected.\nPR:L - nfnetlink_rcv_msg() checks netlink_net_capable(skb, CAP_NET_ADMIN), which is satisfied against the network namespace's owning user namespace, so any unprivileged local user can obtain it with `unshare -Urn` and then create the malformed set. This is the standard unprivileged-user-namespace path used by public nftables exploits.\nUI:N - The attacker performs all steps themselves through netlink; no victim action, mount, or file open is needed.\nS:U - The out-of-bounds accesses and the corrupted pipapo state remain within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - pipapo consumes round_up(klen,4) bytes from buffers holding only klen, reading past the end of the heap-allocated element extension (key_end) and consuming uninitialized kernel stack bytes from the on-stack struct nft_set_elem. Those out-of-bounds values are baked into the set's lookup tables and can be recovered by an attacker probing match results through the packet path, yielding kernel heap/stack disclosure.\nI:H - Kernel data structures (the pipapo lookup and mapping tables) are populated from memory outside the intended key object, so set state is corrupted with out-of-bounds content and packet-matching verdicts, maps, and NAT decisions become dependent on that data. Consistent with kernel-CNA precedent for local nftables/ebtables out-of-bounds accesses, the memory-safety violation is treated as High integrity impact.\nA:H - The slab out-of-bounds read past the element extension is a KASAN-reportable memory-safety violation that panics on hardened/panic_on_warn configurations and can fault when the object abuts an unmapped region, and the corrupted range endpoints drive pipapo_expand() rule expansion from garbage. Any such kernel crash is scored High."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:54:43.241Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.209","versionEndExcluding":"5.10.235"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.148","versionEndExcluding":"5.15.179"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.75","versionEndExcluding":"6.1.129"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.14","versionEndExcluding":"6.6.76"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.12.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.13.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T20:59:57.565Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - BIOS","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-503939.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:04:36.090Z"},"x_adpType":"supplier"}]}}}