CVE-2025-21826

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21826
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject mismatching sum of field_len with set key length The field length description provides the length of each separated key field in the concatenation, each field gets rounded up to 32-bits to calculate the pipapo rule width from pipapo_init(). The set key length provides the total size of the key aligned to 32-bits. Register-based arithmetics still allows for combining mismatching set key length and field length description, eg. set key length 10 and field description [ 5, 4 ] leading to pipapo width of 12.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1b9335a8000fb70742f7db10af314104b6ace220 Patch
https://git.kernel.org/stable/c/2ac254343d3cf228ae0738b2615fedf85d000752 Patch
https://git.kernel.org/stable/c/49b7182b97bafbd5645414aff054b4a65d05823d Patch
https://git.kernel.org/stable/c/5083a7ae45003456c253e981b30a43f71230b4a3 Patch
https://git.kernel.org/stable/c/6b467c8feac759f4c5c86d708beca2aa2b29584f Patch
https://git.kernel.org/stable/c/82e491e085719068179ff6a5466b7387cc4bbf32 Patch
https://git.kernel.org/stable/c/ab50d0eff4a939d20c37721fd9766347efcdb6f6 Patch
https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

03 Nov 2025, 21:19

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html -

03 Nov 2025, 20:17

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html -

30 Oct 2025, 21:39

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/1b9335a8000fb70742f7db10af314104b6ace220 - () https://git.kernel.org/stable/c/1b9335a8000fb70742f7db10af314104b6ace220 - Patch
References () https://git.kernel.org/stable/c/2ac254343d3cf228ae0738b2615fedf85d000752 - () https://git.kernel.org/stable/c/2ac254343d3cf228ae0738b2615fedf85d000752 - Patch
References () https://git.kernel.org/stable/c/49b7182b97bafbd5645414aff054b4a65d05823d - () https://git.kernel.org/stable/c/49b7182b97bafbd5645414aff054b4a65d05823d - Patch
References () https://git.kernel.org/stable/c/5083a7ae45003456c253e981b30a43f71230b4a3 - () https://git.kernel.org/stable/c/5083a7ae45003456c253e981b30a43f71230b4a3 - Patch
References () https://git.kernel.org/stable/c/6b467c8feac759f4c5c86d708beca2aa2b29584f - () https://git.kernel.org/stable/c/6b467c8feac759f4c5c86d708beca2aa2b29584f - Patch
References () https://git.kernel.org/stable/c/82e491e085719068179ff6a5466b7387cc4bbf32 - () https://git.kernel.org/stable/c/82e491e085719068179ff6a5466b7387cc4bbf32 - Patch
References () https://git.kernel.org/stable/c/ab50d0eff4a939d20c37721fd9766347efcdb6f6 - () https://git.kernel.org/stable/c/ab50d0eff4a939d20c37721fd9766347efcdb6f6 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE NVD-CWE-noinfo
First Time Linux
Linux linux Kernel

13 Mar 2025, 13:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/5083a7ae45003456c253e981b30a43f71230b4a3 -
  • () https://git.kernel.org/stable/c/6b467c8feac759f4c5c86d708beca2aa2b29584f -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nf_tables: rechaza la suma no coincidente de field_len con la longitud de la clave establecida La descripción de la longitud del campo proporciona la longitud de cada campo de clave separado en la concatenación, cada campo se redondea a 32 bits para calcular el ancho de la regla pipapo desde pipapo_init(). La longitud de la clave establecida proporciona el tamaño total de la clave alineada a 32 bits. La aritmética basada en registros aún permite combinar la longitud de la clave establecida y la descripción de la longitud del campo no coincidentes, p. ej., la longitud de la clave establecida 10 y la descripción del campo [ 5, 4 ], lo que lleva a un ancho de pipapo de 12.

06 Mar 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-06 16:15

Updated : 2025-11-03 21:19

NVD link : CVE-2025-21826

Mitre link : CVE-2025-21826

CVE.ORG link : CVE-2025-21826

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo