CVE-2025-21826

netfilter: nf_tables: reject mismatching sum of field_len with set key length

State: Published
Severity: 7.8 High
Published: Mar 6, 2025
Updated: Oct 15, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: reject mismatching sum of field_len with set key length

The field length description provides the length of each separated key field in the concatenation, each field gets rounded up to 32-bits to calculate the pipapo rule width from pipapo_init(). The set key length provides the total size of the key aligned to 32-bits.

Register-based arithmetics still allows for combining mismatching set key length and field length description, eg. set key length 10 and field description [ 5, 4 ] leading to pipapo width of 12.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2d4c0798a1ef8db15b3277697ac2def4eda42312 to before 6b467c8feac759f4c5c86d708beca2aa2b29584fAffected 77be8c495a3f841e88b46508cc20d3d7d3289da3 to before 5083a7ae45003456c253e981b30a43f71230b4a3Affected 9cb084df01e198119de477ac691d682fb01e80f3 to before 2ac254343d3cf228ae0738b2615fedf85d000752Affected dc45bb00e66a33de1abb29e3d587880e1d4d9a7e to before 82e491e085719068179ff6a5466b7387cc4bbf32Affected 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 to before 49b7182b97bafbd5645414aff054b4a65d05823dAffected 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 to before ab50d0eff4a939d20c37721fd9766347efcdb6f6Affected 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 to before 1b9335a8000fb70742f7db10af314104b6ace220Affected ff67e3e488090908dc015ba04d7407d8bd467f7eAffected 5.10.209 to before 5.10.235Affected 5.15.148 to before 5.15.179Affected 6.1.75 to before 6.1.129Affected 6.6.14 to before 6.6.76Affected 6.7.2 to before 6.8Affected
LinuxLinux	6.8Affected before 6.8Not affected 5.10.235 through 5.10.Not affected 5.15.179 through 5.15.Not affected 6.1.129 through 6.1.Not affected 6.6.76 through 6.6.Not affected 6.12.13 through 6.12.Not affected 6.13.2 through 6.13.Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

2d4c0798a1ef8db15b3277697ac2def4eda42312 to before 6b467c8feac759f4c5c86d708beca2aa2b29584fAffected
77be8c495a3f841e88b46508cc20d3d7d3289da3 to before 5083a7ae45003456c253e981b30a43f71230b4a3Affected
9cb084df01e198119de477ac691d682fb01e80f3 to before 2ac254343d3cf228ae0738b2615fedf85d000752Affected
dc45bb00e66a33de1abb29e3d587880e1d4d9a7e to before 82e491e085719068179ff6a5466b7387cc4bbf32Affected
3ce67e3793f48c1b9635beb9bb71116ca1e51b58 to before 49b7182b97bafbd5645414aff054b4a65d05823dAffected
3ce67e3793f48c1b9635beb9bb71116ca1e51b58 to before ab50d0eff4a939d20c37721fd9766347efcdb6f6Affected
3ce67e3793f48c1b9635beb9bb71116ca1e51b58 to before 1b9335a8000fb70742f7db10af314104b6ace220Affected
ff67e3e488090908dc015ba04d7407d8bd467f7eAffected
5.10.209 to before 5.10.235Affected
5.15.148 to before 5.15.179Affected
6.1.75 to before 6.1.129Affected
6.6.14 to before 6.6.76Affected
6.7.2 to before 6.8Affected

LinuxLinux

6.8Affected
before 6.8Not affected
5.10.235 through 5.10.*Not affected
5.15.179 through 5.15.*Not affected
6.1.129 through 6.1.*Not affected
6.6.76 through 6.6.*Not affected
6.12.13 through 6.12.*Not affected
6.13.2 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.