Login Sign Up

CVE-2025-21826

5.5 MEDIUM

📋 TL;DR

A vulnerability in the Linux kernel's netfilter nf_tables subsystem allows mismatched key length calculations when creating pipapo rules. This could lead to memory corruption or kernel crashes. Systems running vulnerable Linux kernel versions with nf_tables enabled are affected.

💻 Affected Systems

Products:
  • Linux kernel
Versions: Specific versions between initial introduction of the bug and patched versions (exact range depends on distribution backports)
Operating Systems: Linux distributions using affected kernel versions
Default Config Vulnerable: ✅ No
Notes: Only vulnerable if nf_tables subsystem is enabled and being used. Many distributions don't enable nf_tables by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, or potential privilege escalation if memory corruption can be controlled.

🟠

Likely Case

System crash or denial of service when specific nf_tables rules are created with mismatched parameters.

🟢

If Mitigated

Minimal impact if nf_tables is not used or proper input validation prevents rule creation.

🌐 Internet-Facing: MEDIUM - Requires specific nf_tables rule creation, but could be triggered remotely if firewall rules are manipulated.
🏢 Internal Only: MEDIUM - Local users or processes could trigger the vulnerability through nf_tables operations.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: HIGH

Exploitation requires ability to create nf_tables rules, which typically requires CAP_NET_ADMIN capabilities. The vulnerability is in rule validation logic.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel commits: 1b9335a8000fb70742f7db10af314104b6ace220 and related stable backports

Vendor Advisory: https://git.kernel.org/stable/c/1b9335a8000fb70742f7db10af314104b6ace220

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify nf_tables functionality if required.

🔧 Temporary Workarounds

Disable nf_tables

linux

Prevent use of nf_tables subsystem if not required

modprobe -r nf_tables
echo 'blacklist nf_tables' >> /etc/modprobe.d/blacklist.conf

Restrict nf_tables rule creation

linux

Limit CAP_NET_ADMIN capabilities to prevent unauthorized rule creation

Use Linux capabilities or SELinux/AppArmor to restrict nf_tables access

🧯 If You Can't Patch

  • Disable nf_tables module if not required for system functionality
  • Implement strict access controls to prevent unauthorized users from creating nf_tables rules

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if nf_tables module is loaded: 'uname -r' and 'lsmod | grep nf_tables'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and test nf_tables rule creation with previously problematic parameters

📡 Detection & Monitoring

Log Indicators:

  • Kernel panic logs
  • nf_tables rule creation failures in system logs
  • dmesg errors related to netfilter

Network Indicators:

  • Unexpected firewall rule changes
  • Network connectivity issues after rule modifications

SIEM Query:

source="kernel" AND ("nf_tables" OR "netfilter") AND ("panic" OR "BUG" OR "Oops")

📊 Metadata

CVE ID: CVE-2025-21826
CVSS v3 Score: 5.5 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score: 0.06% exploit probability (18.6th percentile)
Published: March 6, 2025
Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON