CVE-2025-21826: netfilter: nf_tables: reject mismatching sum of field_len with set key length
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: reject mismatching sum of fieldlen with set key length
The field length description provides the length of each separated key field in the concatenation, each field gets rounded up to 32-bits to calculate the pipapo rule width from pipapoinit(). The set key length provides the total size of the key aligned to 32-bits.
Register-based arithmetics still allows for combining mismatching set key length and field length description, eg. set key length 10 and field description [ 5, 4 ] leading to pipapo width of 12.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21826?
CVE-2025-21826 has a medium severity level that may impact the stability of the Linux kernel's netfilter functionality.
How do I fix CVE-2025-21826?
To fix CVE-2025-21826, update the Linux kernel to the latest version where this vulnerability is patched.
What systems are affected by CVE-2025-21826?
CVE-2025-21826 affects various versions of the Linux kernel, specifically those using the netfilter framework.
What are the potential impacts of CVE-2025-21826?
The potential impacts of CVE-2025-21826 include denial of service or other instability in network data handling.
How can I determine if I am vulnerable to CVE-2025-21826?
To determine if you are vulnerable to CVE-2025-21826, check if your current Linux kernel version is affected by the vulnerability.