CVE-2025-21826netfilter: nf_tables: reject mismatching sum of field_len with set key length
Updated under an hour ago ()
Does this affect you?
It affects Linux and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject mismatching sum of field_len with set key length The field length description provides the length of each separated key field in the concatenation, each field gets rounded up to 32-bits to calculate the pipapo rule width from pipapo_init(). The set key length provides the total size of the key aligned to 32-bits. Register-based arithmetics still allows for combining mismatching set key length and field length description, eg. set key length 10 and field description [ 5, 4 ] leading to pipapo width of 12.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Not yet received
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from 2d4c0798a1ef8db15b3277697ac2def4eda42312 before 6b467c8feac759f4c5c86d708beca2aa2b29584f; from 77be8c495a3f841e88b46508cc20d3d7d3289da3 before 5083a7ae45003456c253e981b30a43f71230b4a3; 9cb084df01e198119de477ac691d682fb01e80f3 builds before 2ac254343d3cf228ae0738b2615fedf85d000752; from dc45bb00e66a33de1abb29e3d587880e1d4d9a7e before 82e491e085719068179ff6a5466b7387cc4bbf32; from 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 before 49b7182b97bafbd5645414aff054b4a65d05823d; from 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 before ab50d0eff4a939d20c37721fd9766347efcdb6f6; 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 builds before 1b9335a8000fb70742f7db10af314104b6ace220; ff67e3e488090908dc015ba04d7407d8bd467f7e; and 5 more ranges | CNA record |
Siemens SIMATIC S7-1500 TM MFP - BIOS siemens:simatic_s7_1500_tm_mfp_bios (from the name) | all versions | CISA ADP |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | all versions | CISA ADP |
References
- https://git.kernel.org/stable/c/6b467c8feac759f4c5c86d708beca2aa2b29584f
- https://git.kernel.org/stable/c/5083a7ae45003456c253e981b30a43f71230b4a3
- https://git.kernel.org/stable/c/2ac254343d3cf228ae0738b2615fedf85d000752
- https://git.kernel.org/stable/c/82e491e085719068179ff6a5466b7387cc4bbf32
- https://git.kernel.org/stable/c/49b7182b97bafbd5645414aff054b4a65d05823d
- https://git.kernel.org/stable/c/ab50d0eff4a939d20c37721fd9766347efcdb6f6
- https://git.kernel.org/stable/c/1b9335a8000fb70742f7db10af314104b6ace220
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.