ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2025-22021

In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packe

Published Apr 16, 2025 · catalog updated Oct 15, 2026 · Linux Linux

Check this week

CVE-2025-22021 is not in CISA KEV. FIRST estimates a 46.00% chance of exploitation in the next 30 days. Check whether you run Linux Linux.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Critical10.0
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
46.00%
Remediation
Version ranges on file
Affected products
cpe linux/linux kernel · vendor Linux Linux eb31628e37a0a4e01fffd79dcc7f815d2357f53a <1ec43100f7123010730b7ddfc3d5c2eac19e70e7

In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to restore the original 5-tuple in case of SNAT, to be able to find the right socket (if any). Then socket_match() can correctly check whether the socket was transparent. However, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this conntrack lookup, making xt_socket fail to match on the socket when the packet was SNATed. Add the same logic to nf_sk_lookup_slow_v6. IPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as pods' addresses are in the fd00::/8 ULA subnet and need to be replaced with the node's external address. Cilium leverages Envoy to enforce L7 policies, and Envoy uses transparent sockets. Cilium inserts an iptables prerouting rule that matches on and redirects the packets to localhost, but it fails to match SNATed IPv6 packets due to that missing conntrack lookup.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe linux/linux kernel6.14
  • vendor Linux Linux eb31628e37a0a4e01fffd79dcc7f815d2357f53a <1ec43100f7123010730b7ddfc3d5c2eac19e70e7eb31628e37a0a4e01fffd79dcc7f815d2357f53a <1ec43100f7123010730b7ddfc3d5c2eac19e70e7

How to fix CVE-2025-22021

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2025-22021 is not in CISA KEV. FIRST estimates a 46.00% chance of exploitation in the next 30 days. Check whether you run Linux Linux.

Which versions are affected?

Compare what you have installed with linux/linux kernel 6.14; Linux Linux eb31628e37a0a4e01fffd79dcc7f815d2357f53a <1ec43100f7123010730b7ddfc3d5c2eac19e70e7 eb31628e37a0a4e01fffd79dcc7f815d2357f53a <1ec43100f7123010730b7ddfc3d5c2eac19e70e7. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 46.00%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 16, 2025 · NIST NVD

    Detected

    In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to restore the original 5-tuple in case of SNAT, to be able to find the right socket (if any). Then socket_match() can correctly check whether the socket was transparent. However, the IPv6 counterpart (nf_sk_lookup_sl

  2. Oct 15, 2026 · NIST NVD

    Updated

    In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to restore the original 5-tuple in case of SNAT, to be able to find the right socket (if any). Then socket_match() can correctly check whether the socket was transparent. However, the IPv6 counterpart (nf_sk_lookup_sl

Sources

  • CVE.orgVulnerability recordCVE-2025-22021

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2025-22021

    30-day exploitation probability 46.0%

    first.org
  • EUVDVulnerability recordEUVD-2025-11372

    In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to restore the original 5-tuple in case of SNAT, to be able to find the right socket (if any). Th

    euvd.enisa.europa.eu
  • NIST NVDVulnerability recordCVE-2025-22021

    In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to restore the original 5-tuple in case of SNAT, to be able to find the right socket (if any).

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 17, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.