CVE-2025-22021 (GCVE-0-2025-22021)

Vulnerability from cvelistv5 – Published: 2025-04-16 10:20 – Updated: 2026-08-05 11:56
VLAI
Title
netfilter: socket: Lookup orig tuple for IPv6 SNAT
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to restore the original 5-tuple in case of SNAT, to be able to find the right socket (if any). Then socket_match() can correctly check whether the socket was transparent. However, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this conntrack lookup, making xt_socket fail to match on the socket when the packet was SNATed. Add the same logic to nf_sk_lookup_slow_v6. IPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as pods' addresses are in the fd00::/8 ULA subnet and need to be replaced with the node's external address. Cilium leverages Envoy to enforce L7 policies, and Envoy uses transparent sockets. Cilium inserts an iptables prerouting rule that matches on `-m socket --transparent` and redirects the packets to localhost, but it fails to match SNATed IPv6 packets due to that missing conntrack lookup.
Severity
10 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: eb31628e37a0a4e01fffd79dcc7f815d2357f53a , < 6488b96a79a26e19100ad872622f04e93b638d7f (git)
Affected: eb31628e37a0a4e01fffd79dcc7f815d2357f53a , < 58ab63d3ded2ca6141357a2b24eee8453d0f871d (git)
Affected: eb31628e37a0a4e01fffd79dcc7f815d2357f53a , < 1ca2169cc19dca893c7aae6af122852097435d16 (git)
Affected: eb31628e37a0a4e01fffd79dcc7f815d2357f53a , < 1ec43100f7123010730b7ddfc3d5c2eac19e70e7 (git)
Affected: eb31628e37a0a4e01fffd79dcc7f815d2357f53a , < 5251041573850e5020cd447374e23010be698898 (git)
Affected: eb31628e37a0a4e01fffd79dcc7f815d2357f53a , < 2bb139e483f8cbe488d19d8c1135ac3615e2668c (git)
Affected: eb31628e37a0a4e01fffd79dcc7f815d2357f53a , < 41904cbb343d115931d6bf79aa2c815cac4ef72b (git)
Affected: eb31628e37a0a4e01fffd79dcc7f815d2357f53a , < 221c27259324ec1404f028d4f5a0f2ae7f63ee23 (git)
Affected: eb31628e37a0a4e01fffd79dcc7f815d2357f53a , < 932b32ffd7604fb00b5c57e239a3cc4d901ccf6e (git)
Create a notification for this product.
Linux Linux Affected: 3.13
Unaffected: 0 , < 3.13 (semver)
Unaffected: 5.4.292 , ≤ 5.4.* (semver)
Unaffected: 5.10.236 , ≤ 5.10.* (semver)
Unaffected: 5.15.180 , ≤ 5.15.* (semver)
Unaffected: 6.1.133 , ≤ 6.1.* (semver)
Unaffected: 6.6.86 , ≤ 6.6.* (semver)
Unaffected: 6.12.22 , ≤ 6.12.* (semver)
Unaffected: 6.13.10 , ≤ 6.13.* (semver)
Unaffected: 6.14.1 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:41:09.284Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/netfilter/nf_socket_ipv6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6488b96a79a26e19100ad872622f04e93b638d7f",
              "status": "affected",
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "versionType": "git"
            },
            {
              "lessThan": "58ab63d3ded2ca6141357a2b24eee8453d0f871d",
              "status": "affected",
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "versionType": "git"
            },
            {
              "lessThan": "1ca2169cc19dca893c7aae6af122852097435d16",
              "status": "affected",
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "versionType": "git"
            },
            {
              "lessThan": "1ec43100f7123010730b7ddfc3d5c2eac19e70e7",
              "status": "affected",
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "versionType": "git"
            },
            {
              "lessThan": "5251041573850e5020cd447374e23010be698898",
              "status": "affected",
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "versionType": "git"
            },
            {
              "lessThan": "2bb139e483f8cbe488d19d8c1135ac3615e2668c",
              "status": "affected",
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "versionType": "git"
            },
            {
              "lessThan": "41904cbb343d115931d6bf79aa2c815cac4ef72b",
              "status": "affected",
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "versionType": "git"
            },
            {
              "lessThan": "221c27259324ec1404f028d4f5a0f2ae7f63ee23",
              "status": "affected",
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "versionType": "git"
            },
            {
              "lessThan": "932b32ffd7604fb00b5c57e239a3cc4d901ccf6e",
              "status": "affected",
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/netfilter/nf_socket_ipv6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.236",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.133",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.292",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.236",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.133",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.86",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.22",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.10",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.1",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: socket: Lookup orig tuple for IPv6 SNAT\n\nnf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to\nrestore the original 5-tuple in case of SNAT, to be able to find the\nright socket (if any). Then socket_match() can correctly check whether\nthe socket was transparent.\n\nHowever, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this\nconntrack lookup, making xt_socket fail to match on the socket when the\npacket was SNATed. Add the same logic to nf_sk_lookup_slow_v6.\n\nIPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as\npods\u0027 addresses are in the fd00::/8 ULA subnet and need to be replaced\nwith the node\u0027s external address. Cilium leverages Envoy to enforce L7\npolicies, and Envoy uses transparent sockets. Cilium inserts an iptables\nprerouting rule that matches on `-m socket --transparent` and redirects\nthe packets to localhost, but it fails to match SNATed IPv6 packets due\nto that missing conntrack lookup."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The defective lookup executes in the netfilter PREROUTING path on IPv6 packets received from a remote peer; no local access is involved, and the enforcement failure manifests on unsolicited inbound reply traffic from arbitrary internet hosts.\nAC:L - The missing conntrack original-tuple lookup fails deterministically for every SNATed IPv6 reply flow \u2014 there is no race, timing window, or memory-layout precondition, and hook ordering (mangle -150 before NAT_DST -100) guarantees the socket is never found.\nPR:N - The packet that triggers the mis-lookup arrives from an unauthenticated off-node peer that holds no credentials on the target, and the resulting bypass of the transparent-proxy diversion rule requires no privileges anywhere in the path.\nUI:N - Packets are processed automatically by the netfilter hooks on receipt; no administrator or user action is needed for the socket match to fail.\nS:C - The vulnerable component is the kernel\u0027s packet-filtering/redirection engine, but the impacted resources are the workloads it protects \u2014 pods in separate network namespaces and the userspace L7 policy authority (Envoy) whose enforcement point is bypassed \u2014 matching the CVSS filtering-component-fails-to-protect-downstream-systems case.\nC:H - Bypassing the transparent-proxy diversion means traffic that L7 policy was meant to inspect and restrict flows uninspected, allowing a workload or remote peer to reach and retrieve data from endpoints the policy forbids; the same failure defeats `socket cgroupv2`/`socket mark` based nftables access rules.\nI:H - Unauthorized, uninspected traffic is delivered to protected workloads instead of the enforcement proxy, breaking the \"all traffic traverses the policy point\" invariant and letting an attacker inject content past the L7 filter into the protected component.\nA:H - Where the ruleset is fail-closed, reply packets never reach the transparent socket at all, so every SNATed IPv6 proxied connection breaks \u2014 a complete loss of availability for the affected service, which is exactly the symptom reported against Cilium (issue #37932)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:03.614Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6488b96a79a26e19100ad872622f04e93b638d7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/58ab63d3ded2ca6141357a2b24eee8453d0f871d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ca2169cc19dca893c7aae6af122852097435d16"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ec43100f7123010730b7ddfc3d5c2eac19e70e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/5251041573850e5020cd447374e23010be698898"
        },
        {
          "url": "https://git.kernel.org/stable/c/2bb139e483f8cbe488d19d8c1135ac3615e2668c"
        },
        {
          "url": "https://git.kernel.org/stable/c/41904cbb343d115931d6bf79aa2c815cac4ef72b"
        },
        {
          "url": "https://git.kernel.org/stable/c/221c27259324ec1404f028d4f5a0f2ae7f63ee23"
        },
        {
          "url": "https://git.kernel.org/stable/c/932b32ffd7604fb00b5c57e239a3cc4d901ccf6e"
        }
      ],
      "title": "netfilter: socket: Lookup orig tuple for IPv6 SNAT",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22021",
    "datePublished": "2025-04-16T10:20:37.695Z",
    "dateReserved": "2024-12-29T08:45:45.807Z",
    "dateUpdated": "2026-08-05T11:56:03.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-22021",
      "date": "2026-08-05",
      "epss": "0.00429",
      "percentile": "0.35302"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-22021\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-16T11:15:42.773\",\"lastModified\":\"2026-07-30T06:22:03.707\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: socket: Lookup orig tuple for IPv6 SNAT\\n\\nnf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to\\nrestore the original 5-tuple in case of SNAT, to be able to find the\\nright socket (if any). Then socket_match() can correctly check whether\\nthe socket was transparent.\\n\\nHowever, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this\\nconntrack lookup, making xt_socket fail to match on the socket when the\\npacket was SNATed. Add the same logic to nf_sk_lookup_slow_v6.\\n\\nIPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as\\npods\u0027 addresses are in the fd00::/8 ULA subnet and need to be replaced\\nwith the node\u0027s external address. Cilium leverages Envoy to enforce L7\\npolicies, and Envoy uses transparent sockets. Cilium inserts an iptables\\nprerouting rule that matches on `-m socket --transparent` and redirects\\nthe packets to localhost, but it fails to match SNATed IPv6 packets due\\nto that missing conntrack lookup.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: socket: Lookup orig tuple for IPv6 SNAT nf_sk_lookup_slow_v4 realiza la b\u00fasqueda conntrack de paquetes IPv4 para restaurar la 5-tupla original en caso de SNAT, para poder encontrar el socket correcto (si lo hay). Entonces socket_match() puede verificar correctamente si el socket era transparente. Sin embargo, la contraparte IPv6 (nf_sk_lookup_slow_v6) carece de esta b\u00fasqueda conntrack, lo que hace que xt_socket no coincida en el socket cuando el paquete fue SNATed. Agregue la misma l\u00f3gica a nf_sk_lookup_slow_v6. SNAT IPv6 se usa en cl\u00fasteres de Kubernetes para paquetes pod-to-world, ya que las direcciones de los pods est\u00e1n en la subred fd00::/8 ULA y deben reemplazarse con la direcci\u00f3n externa del nodo. Cilium utiliza Envoy para implementar pol\u00edticas L7, y Envoy utiliza sockets transparentes. Cilium inserta una regla de preenrutamiento de iptables que coincide con `-m socket --transparent` y redirige los paquetes a localhost, pero no coincide con los paquetes IPv6 SNAT debido a la falta de b\u00fasqueda de conntrack.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv6/netfilter/nf_socket_ipv6.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"eb31628e37a0a4e01fffd79dcc7f815d2357f53a\",\"lessThan\":\"6488b96a79a26e19100ad872622f04e93b638d7f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eb31628e37a0a4e01fffd79dcc7f815d2357f53a\",\"lessThan\":\"58ab63d3ded2ca6141357a2b24eee8453d0f871d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eb31628e37a0a4e01fffd79dcc7f815d2357f53a\",\"lessThan\":\"1ca2169cc19dca893c7aae6af122852097435d16\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eb31628e37a0a4e01fffd79dcc7f815d2357f53a\",\"lessThan\":\"1ec43100f7123010730b7ddfc3d5c2eac19e70e7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eb31628e37a0a4e01fffd79dcc7f815d2357f53a\",\"lessThan\":\"5251041573850e5020cd447374e23010be698898\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eb31628e37a0a4e01fffd79dcc7f815d2357f53a\",\"lessThan\":\"2bb139e483f8cbe488d19d8c1135ac3615e2668c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eb31628e37a0a4e01fffd79dcc7f815d2357f53a\",\"lessThan\":\"41904cbb343d115931d6bf79aa2c815cac4ef72b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eb31628e37a0a4e01fffd79dcc7f815d2357f53a\",\"lessThan\":\"221c27259324ec1404f028d4f5a0f2ae7f63ee23\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eb31628e37a0a4e01fffd79dcc7f815d2357f53a\",\"lessThan\":\"932b32ffd7604fb00b5c57e239a3cc4d901ccf6e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv6/netfilter/nf_socket_ipv6.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.292\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.236\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.180\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.133\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.86\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.22\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.10\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.1\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.13\",\"versionEndExcluding\":\"5.4.292\",\"matchCriteriaId\":\"7F195470-F0D7-4E43-9F03-A295DFCF6531\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.236\",\"matchCriteriaId\":\"1DF46FB0-9163-4ABE-8CCA-32A497D4715B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.180\",\"matchCriteriaId\":\"D19801C8-3D18-405D-9989-E6C9B30255FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.133\",\"matchCriteriaId\":\"F0054446-3F3B-42C4-BDB3-8FDD29D57F23\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.86\",\"matchCriteriaId\":\"5DB427C2-3400-4B39-AC18-49AECE5221B5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.22\",\"matchCriteriaId\":\"9F037D3C-D627-4151-8546-1A2E3C2B38A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.10\",\"matchCriteriaId\":\"E9410CA0-CED8-49BE-9DB4-856654736C32\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"82E37853-46C8-4BB6-9FA4-9838FD34D6A2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1ca2169cc19dca893c7aae6af122852097435d16\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1ec43100f7123010730b7ddfc3d5c2eac19e70e7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/221c27259324ec1404f028d4f5a0f2ae7f63ee23\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2bb139e483f8cbe488d19d8c1135ac3615e2668c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/41904cbb343d115931d6bf79aa2c815cac4ef72b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5251041573850e5020cd447374e23010be698898\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/58ab63d3ded2ca6141357a2b24eee8453d0f871d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6488b96a79a26e19100ad872622f04e93b638d7f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/932b32ffd7604fb00b5c57e239a3cc4d901ccf6e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:37:47+00:00",
      "cve": "CVE-2025-22021",
      "id": "CVE-2025-22021",
      "initial_release_date": "2025-04-16T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: socket: Lookup orig tuple for IPv6 SNAT",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-22021.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-07-15T06:22:56Z",
      "cve": "CVE-2025-22021",
      "id": "CVE-2025-22021",
      "initial_release_date": "2025-04-17T01:33:28Z",
      "product_status:known_affected": "668",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "414",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-22021",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-22021.json",
      "version": "36"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.