CVE-2025-22021

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-22021", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.807Z", "datePublished": "2025-04-16T10:20:37.695Z", "dateUpdated": "2026-10-15T21:51:56.689Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:56:03.614Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: socket: Lookup orig tuple for IPv6 SNAT\n\nnf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to\nrestore the original 5-tuple in case of SNAT, to be able to find the\nright socket (if any). Then socket_match() can correctly check whether\nthe socket was transparent.\n\nHowever, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this\nconntrack lookup, making xt_socket fail to match on the socket when the\npacket was SNATed. Add the same logic to nf_sk_lookup_slow_v6.\n\nIPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as\npods' addresses are in the fd00::/8 ULA subnet and need to be replaced\nwith the node's external address. Cilium leverages Envoy to enforce L7\npolicies, and Envoy uses transparent sockets. Cilium inserts an iptables\nprerouting rule that matches on `-m socket --transparent` and redirects\nthe packets to localhost, but it fails to match SNATed IPv6 packets due\nto that missing conntrack lookup."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The defective lookup executes in the netfilter PREROUTING path on IPv6 packets received from a remote peer; no local access is involved, and the enforcement failure manifests on unsolicited inbound reply traffic from arbitrary internet hosts.\nAC:L - The missing conntrack original-tuple lookup fails deterministically for every SNATed IPv6 reply flow \u2014 there is no race, timing window, or memory-layout precondition, and hook ordering (mangle -150 before NAT_DST -100) guarantees the socket is never found.\nPR:N - The packet that triggers the mis-lookup arrives from an unauthenticated off-node peer that holds no credentials on the target, and the resulting bypass of the transparent-proxy diversion rule requires no privileges anywhere in the path.\nUI:N - Packets are processed automatically by the netfilter hooks on receipt; no administrator or user action is needed for the socket match to fail.\nS:C - The vulnerable component is the kernel's packet-filtering/redirection engine, but the impacted resources are the workloads it protects \u2014 pods in separate network namespaces and the userspace L7 policy authority (Envoy) whose enforcement point is bypassed \u2014 matching the CVSS filtering-component-fails-to-protect-downstream-systems case.\nC:H - Bypassing the transparent-proxy diversion means traffic that L7 policy was meant to inspect and restrict flows uninspected, allowing a workload or remote peer to reach and retrieve data from endpoints the policy forbids; the same failure defeats `socket cgroupv2`/`socket mark` based nftables access rules.\nI:H - Unauthorized, uninspected traffic is delivered to protected workloads instead of the enforcement proxy, breaking the \"all traffic traverses the policy point\" invariant and letting an attacker inject content past the L7 filter into the protected component.\nA:H - Where the ruleset is fail-closed, reply packets never reach the transparent socket at all, so every SNATed IPv6 proxied connection breaks \u2014 a complete loss of availability for the affected service, which is exactly the symptom reported against Cilium (issue #37932)."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/netfilter/nf_socket_ipv6.c"], "versions": [{"version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "6488b96a79a26e19100ad872622f04e93b638d7f", "status": "affected", "versionType": "git"}, {"version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "58ab63d3ded2ca6141357a2b24eee8453d0f871d", "status": "affected", "versionType": "git"}, {"version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "1ca2169cc19dca893c7aae6af122852097435d16", "status": "affected", "versionType": "git"}, {"version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "1ec43100f7123010730b7ddfc3d5c2eac19e70e7", "status": "affected", "versionType": "git"}, {"version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "5251041573850e5020cd447374e23010be698898", "status": "affected", "versionType": "git"}, {"version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "2bb139e483f8cbe488d19d8c1135ac3615e2668c", "status": "affected", "versionType": "git"}, {"version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "41904cbb343d115931d6bf79aa2c815cac4ef72b", "status": "affected", "versionType": "git"}, {"version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "221c27259324ec1404f028d4f5a0f2ae7f63ee23", "status": "affected", "versionType": "git"}, {"version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "932b32ffd7604fb00b5c57e239a3cc4d901ccf6e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/netfilter/nf_socket_ipv6.c"], "versions": [{"version": "3.13", "status": "affected"}, {"version": "0", "lessThan": "3.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.292", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.236", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.180", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.133", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.86", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.22", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.10", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.1", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.4.292"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.10.236"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.15.180"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.1.133"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.6.86"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.12.22"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.13.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.14.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6488b96a79a26e19100ad872622f04e93b638d7f"}, {"url": "https://git.kernel.org/stable/c/58ab63d3ded2ca6141357a2b24eee8453d0f871d"}, {"url": "https://git.kernel.org/stable/c/1ca2169cc19dca893c7aae6af122852097435d16"}, {"url": "https://git.kernel.org/stable/c/1ec43100f7123010730b7ddfc3d5c2eac19e70e7"}, {"url": "https://git.kernel.org/stable/c/5251041573850e5020cd447374e23010be698898"}, {"url": "https://git.kernel.org/stable/c/2bb139e483f8cbe488d19d8c1135ac3615e2668c"}, {"url": "https://git.kernel.org/stable/c/41904cbb343d115931d6bf79aa2c815cac4ef72b"}, {"url": "https://git.kernel.org/stable/c/221c27259324ec1404f028d4f5a0f2ae7f63ee23"}, {"url": "https://git.kernel.org/stable/c/932b32ffd7604fb00b5c57e239a3cc4d901ccf6e"}], "title": "netfilter: socket: Lookup orig tuple for IPv6 SNAT", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:41:09.284Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-22021", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:44:08.710452Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:51:56.689Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:41:09.284Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-22021", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:44:08.710452Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:44:09.536Z"}}], "cna": {"title": "netfilter: socket: Lookup orig tuple for IPv6 SNAT", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 10, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The defective lookup executes in the netfilter PREROUTING path on IPv6 packets received from a remote peer; no local access is involved, and the enforcement failure manifests on unsolicited inbound reply traffic from arbitrary internet hosts.\nAC:L - The missing conntrack original-tuple lookup fails deterministically for every SNATed IPv6 reply flow \u2014 there is no race, timing window, or memory-layout precondition, and hook ordering (mangle -150 before NAT_DST -100) guarantees the socket is never found.\nPR:N - The packet that triggers the mis-lookup arrives from an unauthenticated off-node peer that holds no credentials on the target, and the resulting bypass of the transparent-proxy diversion rule requires no privileges anywhere in the path.\nUI:N - Packets are processed automatically by the netfilter hooks on receipt; no administrator or user action is needed for the socket match to fail.\nS:C - The vulnerable component is the kernel's packet-filtering/redirection engine, but the impacted resources are the workloads it protects \u2014 pods in separate network namespaces and the userspace L7 policy authority (Envoy) whose enforcement point is bypassed \u2014 matching the CVSS filtering-component-fails-to-protect-downstream-systems case.\nC:H - Bypassing the transparent-proxy diversion means traffic that L7 policy was meant to inspect and restrict flows uninspected, allowing a workload or remote peer to reach and retrieve data from endpoints the policy forbids; the same failure defeats `socket cgroupv2`/`socket mark` based nftables access rules.\nI:H - Unauthorized, uninspected traffic is delivered to protected workloads instead of the enforcement proxy, breaking the \"all traffic traverses the policy point\" invariant and letting an attacker inject content past the L7 filter into the protected component.\nA:H - Where the ruleset is fail-closed, reply packets never reach the transparent socket at all, so every SNATed IPv6 proxied connection breaks \u2014 a complete loss of availability for the affected service, which is exactly the symptom reported against Cilium (issue #37932)."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "6488b96a79a26e19100ad872622f04e93b638d7f", "versionType": "git"}, {"status": "affected", "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "58ab63d3ded2ca6141357a2b24eee8453d0f871d", "versionType": "git"}, {"status": "affected", "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "1ca2169cc19dca893c7aae6af122852097435d16", "versionType": "git"}, {"status": "affected", "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "1ec43100f7123010730b7ddfc3d5c2eac19e70e7", "versionType": "git"}, {"status": "affected", "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "5251041573850e5020cd447374e23010be698898", "versionType": "git"}, {"status": "affected", "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "2bb139e483f8cbe488d19d8c1135ac3615e2668c", "versionType": "git"}, {"status": "affected", "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "41904cbb343d115931d6bf79aa2c815cac4ef72b", "versionType": "git"}, {"status": "affected", "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "221c27259324ec1404f028d4f5a0f2ae7f63ee23", "versionType": "git"}, {"status": "affected", "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "932b32ffd7604fb00b5c57e239a3cc4d901ccf6e", "versionType": "git"}], "programFiles": ["net/ipv6/netfilter/nf_socket_ipv6.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.13"}, {"status": "unaffected", "version": "0", "lessThan": "3.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.292", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.236", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.180", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.133", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.86", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.22", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13.10", "versionType": "semver", "lessThanOrEqual": "6.13.*"}, {"status": "unaffected", "version": "6.14.1", "versionType": "semver", "lessThanOrEqual": "6.14.*"}, {"status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ipv6/netfilter/nf_socket_ipv6.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/6488b96a79a26e19100ad872622f04e93b638d7f"}, {"url": "https://git.kernel.org/stable/c/58ab63d3ded2ca6141357a2b24eee8453d0f871d"}, {"url": "https://git.kernel.org/stable/c/1ca2169cc19dca893c7aae6af122852097435d16"}, {"url": "https://git.kernel.org/stable/c/1ec43100f7123010730b7ddfc3d5c2eac19e70e7"}, {"url": "https://git.kernel.org/stable/c/5251041573850e5020cd447374e23010be698898"}, {"url": "https://git.kernel.org/stable/c/2bb139e483f8cbe488d19d8c1135ac3615e2668c"}, {"url": "https://git.kernel.org/stable/c/41904cbb343d115931d6bf79aa2c815cac4ef72b"}, {"url": "https://git.kernel.org/stable/c/221c27259324ec1404f028d4f5a0f2ae7f63ee23"}, {"url": "https://git.kernel.org/stable/c/932b32ffd7604fb00b5c57e239a3cc4d901ccf6e"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: socket: Lookup orig tuple for IPv6 SNAT\n\nnf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to\nrestore the original 5-tuple in case of SNAT, to be able to find the\nright socket (if any). Then socket_match() can correctly check whether\nthe socket was transparent.\n\nHowever, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this\nconntrack lookup, making xt_socket fail to match on the socket when the\npacket was SNATed. Add the same logic to nf_sk_lookup_slow_v6.\n\nIPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as\npods' addresses are in the fd00::/8 ULA subnet and need to be replaced\nwith the node's external address. Cilium leverages Envoy to enforce L7\npolicies, and Envoy uses transparent sockets. Cilium inserts an iptables\nprerouting rule that matches on `-m socket --transparent` and redirects\nthe packets to localhost, but it fails to match SNATed IPv6 packets due\nto that missing conntrack lookup."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.292", "versionStartIncluding": "3.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.236", "versionStartIncluding": "3.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.180", "versionStartIncluding": "3.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.133", "versionStartIncluding": "3.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.86", "versionStartIncluding": "3.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.22", "versionStartIncluding": "3.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.10", "versionStartIncluding": "3.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14.1", "versionStartIncluding": "3.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15", "versionStartIncluding": "3.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:56:03.614Z"}}}, "cveMetadata": {"cveId": "CVE-2025-22021", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:51:56.689Z", "dateReserved": "2024-12-29T08:45:45.807Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-04-16T10:20:37.695Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv6/netfilter/nf_socket_ipv6.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6488b96a79a26e19100ad872622f04e93b638d7f", "status": "affected", "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "versionType": "git"}, {"lessThan": "58ab63d3ded2ca6141357a2b24eee8453d0f871d", "status": "affected", "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "versionType": "git"}, {"lessThan": "1ca2169cc19dca893c7aae6af122852097435d16", "status": "affected", "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "versionType": "git"}, {"lessThan": "1ec43100f7123010730b7ddfc3d5c2eac19e70e7", "status": "affected", "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "versionType": "git"}, {"lessThan": "5251041573850e5020cd447374e23010be698898", "status": "affected", "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "versionType": "git"}, {"lessThan": "2bb139e483f8cbe488d19d8c1135ac3615e2668c", "status": "affected", "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "versionType": "git"}, {"lessThan": "41904cbb343d115931d6bf79aa2c815cac4ef72b", "status": "affected", "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "versionType": "git"}, {"lessThan": "221c27259324ec1404f028d4f5a0f2ae7f63ee23", "status": "affected", "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "versionType": "git"}, {"lessThan": "932b32ffd7604fb00b5c57e239a3cc4d901ccf6e", "status": "affected", "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv6/netfilter/nf_socket_ipv6.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.13"}, {"lessThan": "3.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.292", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.236", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.180", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.133", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.86", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.22", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.10", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7F195470-F0D7-4E43-9F03-A295DFCF6531", "versionEndExcluding": "5.4.292", "versionStartIncluding": "3.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1DF46FB0-9163-4ABE-8CCA-32A497D4715B", "versionEndExcluding": "5.10.236", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D19801C8-3D18-405D-9989-E6C9B30255FA", "versionEndExcluding": "5.15.180", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F0054446-3F3B-42C4-BDB3-8FDD29D57F23", "versionEndExcluding": "6.1.133", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5DB427C2-3400-4B39-AC18-49AECE5221B5", "versionEndExcluding": "6.6.86", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9F037D3C-D627-4151-8546-1A2E3C2B38A8", "versionEndExcluding": "6.12.22", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E9410CA0-CED8-49BE-9DB4-856654736C32", "versionEndExcluding": "6.13.10", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:*:*:*:*:*:*:*", "matchCriteriaId": "82E37853-46C8-4BB6-9FA4-9838FD34D6A2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: socket: Lookup orig tuple for IPv6 SNAT\n\nnf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to\nrestore the original 5-tuple in case of SNAT, to be able to find the\nright socket (if any). Then socket_match() can correctly check whether\nthe socket was transparent.\n\nHowever, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this\nconntrack lookup, making xt_socket fail to match on the socket when the\npacket was SNATed. Add the same logic to nf_sk_lookup_slow_v6.\n\nIPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as\npods' addresses are in the fd00::/8 ULA subnet and need to be replaced\nwith the node's external address. Cilium leverages Envoy to enforce L7\npolicies, and Envoy uses transparent sockets. Cilium inserts an iptables\nprerouting rule that matches on `-m socket --transparent` and redirects\nthe packets to localhost, but it fails to match SNATed IPv6 packets due\nto that missing conntrack lookup."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: socket: Lookup orig tuple for IPv6 SNAT nf_sk_lookup_slow_v4 realiza la b\u00fasqueda conntrack de paquetes IPv4 para restaurar la 5-tupla original en caso de SNAT, para poder encontrar el socket correcto (si lo hay). Entonces socket_match() puede verificar correctamente si el socket era transparente. Sin embargo, la contraparte IPv6 (nf_sk_lookup_slow_v6) carece de esta b\u00fasqueda conntrack, lo que hace que xt_socket no coincida en el socket cuando el paquete fue SNATed. Agregue la misma l\u00f3gica a nf_sk_lookup_slow_v6. SNAT IPv6 se usa en cl\u00fasteres de Kubernetes para paquetes pod-to-world, ya que las direcciones de los pods est\u00e1n en la subred fd00::/8 ULA y deben reemplazarse con la direcci\u00f3n externa del nodo. Cilium utiliza Envoy para implementar pol\u00edticas L7, y Envoy utiliza sockets transparentes. Cilium inserta una regla de preenrutamiento de iptables que coincide con `-m socket --transparent` y redirige los paquetes a localhost, pero no coincide con los paquetes IPv6 SNAT debido a la falta de b\u00fasqueda de conntrack."}], "id": "CVE-2025-22021", "lastModified": "2026-10-15T22:18:13.463", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-22021", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:44:08.710452Z", "version": "2.0.3"}}]}, "published": "2025-04-16T11:15:42.773", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1ca2169cc19dca893c7aae6af122852097435d16"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1ec43100f7123010730b7ddfc3d5c2eac19e70e7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/221c27259324ec1404f028d4f5a0f2ae7f63ee23"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2bb139e483f8cbe488d19d8c1135ac3615e2668c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/41904cbb343d115931d6bf79aa2c815cac4ef72b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5251041573850e5020cd447374e23010be698898"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/58ab63d3ded2ca6141357a2b24eee8453d0f871d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6488b96a79a26e19100ad872622f04e93b638d7f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/932b32ffd7604fb00b5c57e239a3cc4d901ccf6e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: netfilter: socket: Lookup orig tuple for IPv6 SNAT", "id": "2360097", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2360097"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-20", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: socket: Lookup orig tuple for IPv6 SNAT\nnf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to\nrestore the original 5-tuple in case of SNAT, to be able to find the\nright socket (if any). Then socket_match() can correctly check whether\nthe socket was transparent.\nHowever, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this\nconntrack lookup, making xt_socket fail to match on the socket when the\npacket was SNATed. Add the same logic to nf_sk_lookup_slow_v6.\nIPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as\npods' addresses are in the fd00::/8 ULA subnet and need to be replaced\nwith the node's external address. Cilium leverages Envoy to enforce L7\npolicies, and Envoy uses transparent sockets. Cilium inserts an iptables\nprerouting rule that matches on `-m socket --transparent` and redirects\nthe packets to localhost, but it fails to match SNATed IPv6 packets due\nto that missing conntrack lookup."], "name": "CVE-2025-22021", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-04-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-22021\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-22021\nhttps://lore.kernel.org/linux-cve-announce/2025041643-CVE-2025-22021-1089@gregkh/T"], "threat_severity": "Moderate"}

{}