{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-22021", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.807Z", "datePublished": "2025-04-16T10:20:37.695Z", "dateUpdated": "2026-08-05T11:56:03.614Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:56:03.614Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: socket: Lookup orig tuple for IPv6 SNAT\n\nnf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to\nrestore the original 5-tuple in case of SNAT, to be able to find the\nright socket (if any). Then socket_match() can correctly check whether\nthe socket was transparent.\n\nHowever, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this\nconntrack lookup, making xt_socket fail to match on the socket when the\npacket was SNATed. Add the same logic to nf_sk_lookup_slow_v6.\n\nIPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as\npods' addresses are in the fd00::/8 ULA subnet and need to be replaced\nwith the node's external address. Cilium leverages Envoy to enforce L7\npolicies, and Envoy uses transparent sockets. Cilium inserts an iptables\nprerouting rule that matches on `-m socket --transparent` and redirects\nthe packets to localhost, but it fails to match SNATed IPv6 packets due\nto that missing conntrack lookup." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The defective lookup executes in the netfilter PREROUTING path on IPv6 packets received from a remote peer; no local access is involved, and the enforcement failure manifests on unsolicited inbound reply traffic from arbitrary internet hosts.\nAC:L - The missing conntrack original-tuple lookup fails deterministically for every SNATed IPv6 reply flow — there is no race, timing window, or memory-layout precondition, and hook ordering (mangle -150 before NAT_DST -100) guarantees the socket is never found.\nPR:N - The packet that triggers the mis-lookup arrives from an unauthenticated off-node peer that holds no credentials on the target, and the resulting bypass of the transparent-proxy diversion rule requires no privileges anywhere in the path.\nUI:N - Packets are processed automatically by the netfilter hooks on receipt; no administrator or user action is needed for the socket match to fail.\nS:C - The vulnerable component is the kernel's packet-filtering/redirection engine, but the impacted resources are the workloads it protects — pods in separate network namespaces and the userspace L7 policy authority (Envoy) whose enforcement point is bypassed — matching the CVSS filtering-component-fails-to-protect-downstream-systems case.\nC:H - Bypassing the transparent-proxy diversion means traffic that L7 policy was meant to inspect and restrict flows uninspected, allowing a workload or remote peer to reach and retrieve data from endpoints the policy forbids; the same failure defeats `socket cgroupv2`/`socket mark` based nftables access rules.\nI:H - Unauthorized, uninspected traffic is delivered to protected workloads instead of the enforcement proxy, breaking the \"all traffic traverses the policy point\" invariant and letting an attacker inject content past the L7 filter into the protected component.\nA:H - Where the ruleset is fail-closed, reply packets never reach the transparent socket at all, so every SNATed IPv6 proxied connection breaks — a complete loss of availability for the affected service, which is exactly the symptom reported against Cilium (issue #37932)." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv6/netfilter/nf_socket_ipv6.c" ], "versions": [ { "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "6488b96a79a26e19100ad872622f04e93b638d7f", "status": "affected", "versionType": "git" }, { "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "58ab63d3ded2ca6141357a2b24eee8453d0f871d", "status": "affected", "versionType": "git" }, { "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "1ca2169cc19dca893c7aae6af122852097435d16", "status": "affected", "versionType": "git" }, { "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "1ec43100f7123010730b7ddfc3d5c2eac19e70e7", "status": "affected", "versionType": "git" }, { "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "5251041573850e5020cd447374e23010be698898", "status": "affected", "versionType": "git" }, { "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "2bb139e483f8cbe488d19d8c1135ac3615e2668c", "status": "affected", "versionType": "git" }, { "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "41904cbb343d115931d6bf79aa2c815cac4ef72b", "status": "affected", "versionType": "git" }, { "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "221c27259324ec1404f028d4f5a0f2ae7f63ee23", "status": "affected", "versionType": "git" }, { "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a", "lessThan": "932b32ffd7604fb00b5c57e239a3cc4d901ccf6e", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv6/netfilter/nf_socket_ipv6.c" ], "versions": [ { "version": "3.13", "status": "affected" }, { "version": "0", "lessThan": "3.13", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.292", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.236", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.180", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.133", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.86", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.22", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.10", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.1", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.4.292" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.10.236" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.15.180" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.1.133" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.6.86" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.12.22" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.13.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.14.1" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/6488b96a79a26e19100ad872622f04e93b638d7f" }, { "url": "https://git.kernel.org/stable/c/58ab63d3ded2ca6141357a2b24eee8453d0f871d" }, { "url": "https://git.kernel.org/stable/c/1ca2169cc19dca893c7aae6af122852097435d16" }, { "url": "https://git.kernel.org/stable/c/1ec43100f7123010730b7ddfc3d5c2eac19e70e7" }, { "url": "https://git.kernel.org/stable/c/5251041573850e5020cd447374e23010be698898" }, { "url": "https://git.kernel.org/stable/c/2bb139e483f8cbe488d19d8c1135ac3615e2668c" }, { "url": "https://git.kernel.org/stable/c/41904cbb343d115931d6bf79aa2c815cac4ef72b" }, { "url": "https://git.kernel.org/stable/c/221c27259324ec1404f028d4f5a0f2ae7f63ee23" }, { "url": "https://git.kernel.org/stable/c/932b32ffd7604fb00b5c57e239a3cc4d901ccf6e" } ], "title": "netfilter: socket: Lookup orig tuple for IPv6 SNAT", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:41:09.284Z" } } ] } }