CVE-2025-21826 netfilter: nf_tables: reject mismatching sum of field_len with set key length
A logic error in Linux kernel netfilter allows mismatching set key lengths, potentially leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21826?
CVE-2025-21826 is a high-severity vulnerability in Linux kernel, published on 6 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: reject mismatching sum of field_len with set key length
The field length description provides the length of each separated key field in the concatenation, each field gets rounded up to 32-bits to calculate the pipapo rule width from pipapo_init(). The set key length provides the total size of the key aligned to 32-bits.
Register-based arithmetics still allows for combining mismatching set key length and field length description, eg. set key length 10 and field description [ 5, 4 ] leading to pipapo width of 12.
Which versions are affected by CVE-2025-21826?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21826?
Apply the vendor's patch.
Is CVE-2025-21826 being exploited?
There is no known exploitation of CVE-2025-21826 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-21826, DEBIAN-CVE-2025-21826, GHSA-8376-779w-5hcf, ROOT-OS-UBUNTU-2404-CVE-2025-21826, UBUNTU-CVE-2025-21826.