{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-21826","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-12-29T08:45:45.775Z","datePublished":"2025-03-06T16:04:32.274Z","dateUpdated":"2026-08-05T11:54:43.241Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:54:43.241Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: reject mismatching sum of field_len with set key length\n\nThe field length description provides the length of each separated key\nfield in the concatenation, each field gets rounded up to 32-bits to\ncalculate the pipapo rule width from pipapo_init(). The set key length\nprovides the total size of the key aligned to 32-bits.\n\nRegister-based arithmetics still allows for combining mismatching set\nkey length and field length description, eg. set key length 10 and field\ndescription [ 5, 4 ] leading to pipapo width of 12."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached exclusively through nfnetlink/netlink configuration messages to the nf_tables subsystem (NFT_MSG_NEWSET / NFT_MSG_NEWSETELEM), which require local system access. Per kernel scoring guidance, netfilter/nftables netlink paths are Local.\nAC:L - Triggering is fully deterministic and entirely attacker-controlled: create an interval+concat set with any key length not a multiple of 4 (e.g. klen=10 with field description [5,4]) and add one ranged element. No race, no memory-layout luck, and pipapo is the only backend that accepts multi-field interval sets so the vulnerable code is always selected.\nPR:L - nfnetlink_rcv_msg() checks netlink_net_capable(skb, CAP_NET_ADMIN), which is satisfied against the network namespace's owning user namespace, so any unprivileged local user can obtain it with `unshare -Urn` and then create the malformed set. This is the standard unprivileged-user-namespace path used by public nftables exploits.\nUI:N - The attacker performs all steps themselves through netlink; no victim action, mount, or file open is needed.\nS:U - The out-of-bounds accesses and the corrupted pipapo state remain within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - pipapo consumes round_up(klen,4) bytes from buffers holding only klen, reading past the end of the heap-allocated element extension (key_end) and consuming uninitialized kernel stack bytes from the on-stack struct nft_set_elem. Those out-of-bounds values are baked into the set's lookup tables and can be recovered by an attacker probing match results through the packet path, yielding kernel heap/stack disclosure.\nI:H - Kernel data structures (the pipapo lookup and mapping tables) are populated from memory outside the intended key object, so set state is corrupted with out-of-bounds content and packet-matching verdicts, maps, and NAT decisions become dependent on that data. Consistent with kernel-CNA precedent for local nftables/ebtables out-of-bounds accesses, the memory-safety violation is treated as High integrity impact.\nA:H - The slab out-of-bounds read past the element extension is a KASAN-reportable memory-safety violation that panics on hardened/panic_on_warn configurations and can fault when the object abuts an unmapped region, and the corrupted range endpoints drive pipapo_expand() rule expansion from garbage. Any such kernel crash is scored High."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_tables_api.c"],"versions":[{"version":"2d4c0798a1ef8db15b3277697ac2def4eda42312","lessThan":"6b467c8feac759f4c5c86d708beca2aa2b29584f","status":"affected","versionType":"git"},{"version":"77be8c495a3f841e88b46508cc20d3d7d3289da3","lessThan":"5083a7ae45003456c253e981b30a43f71230b4a3","status":"affected","versionType":"git"},{"version":"9cb084df01e198119de477ac691d682fb01e80f3","lessThan":"2ac254343d3cf228ae0738b2615fedf85d000752","status":"affected","versionType":"git"},{"version":"dc45bb00e66a33de1abb29e3d587880e1d4d9a7e","lessThan":"82e491e085719068179ff6a5466b7387cc4bbf32","status":"affected","versionType":"git"},{"version":"3ce67e3793f48c1b9635beb9bb71116ca1e51b58","lessThan":"49b7182b97bafbd5645414aff054b4a65d05823d","status":"affected","versionType":"git"},{"version":"3ce67e3793f48c1b9635beb9bb71116ca1e51b58","lessThan":"ab50d0eff4a939d20c37721fd9766347efcdb6f6","status":"affected","versionType":"git"},{"version":"3ce67e3793f48c1b9635beb9bb71116ca1e51b58","lessThan":"1b9335a8000fb70742f7db10af314104b6ace220","status":"affected","versionType":"git"},{"version":"ff67e3e488090908dc015ba04d7407d8bd467f7e","status":"affected","versionType":"git"},{"version":"5.10.209","lessThan":"5.10.235","status":"affected","versionType":"semver"},{"version":"5.15.148","lessThan":"5.15.179","status":"affected","versionType":"semver"},{"version":"6.1.75","lessThan":"6.1.129","status":"affected","versionType":"semver"},{"version":"6.6.14","lessThan":"6.6.76","status":"affected","versionType":"semver"},{"version":"6.7.2","lessThan":"6.8","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_tables_api.c"],"versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","status":"unaffected","versionType":"semver"},{"version":"5.10.235","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.179","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.129","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.76","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.13","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.13.2","lessThanOrEqual":"6.13.*","status":"unaffected","versionType":"semver"},{"version":"6.14","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.209","versionEndExcluding":"5.10.235"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.148","versionEndExcluding":"5.15.179"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.75","versionEndExcluding":"6.1.129"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.14","versionEndExcluding":"6.6.76"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.12.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.13.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/6b467c8feac759f4c5c86d708beca2aa2b29584f"},{"url":"https://git.kernel.org/stable/c/5083a7ae45003456c253e981b30a43f71230b4a3"},{"url":"https://git.kernel.org/stable/c/2ac254343d3cf228ae0738b2615fedf85d000752"},{"url":"https://git.kernel.org/stable/c/82e491e085719068179ff6a5466b7387cc4bbf32"},{"url":"https://git.kernel.org/stable/c/49b7182b97bafbd5645414aff054b4a65d05823d"},{"url":"https://git.kernel.org/stable/c/ab50d0eff4a939d20c37721fd9766347efcdb6f6"},{"url":"https://git.kernel.org/stable/c/1b9335a8000fb70742f7db10af314104b6ace220"}],"title":"netfilter: nf_tables: reject mismatching sum of field_len with set key length","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T20:59:57.565Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-05-12T12:03:59.800Z"},"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - BIOS","versions":[{"status":"affected","version":"0","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","versions":[{"status":"affected","version":"0","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-503939.html"}]}]}}