VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Mar 6, 2025· Updated May 12, 2026

CVE-2025-21826

CVE-2025-21826

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: reject mismatching sum of field_len with set key length

The field length description provides the length of each separated key field in the concatenation, each field gets rounded up to 32-bits to calculate the pipapo rule width from pipapo_init(). The set key length provides the total size of the key aligned to 32-bits.

Register-based arithmetics still allows for combining mismatching set key length and field length description, eg. set key length 10 and field description [ 5, 4 ] leading to pipapo width of 12.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2025-21826 is a medium-severity vulnerability in the Linux kernel's netfilter subsystem where mismatching field lengths can cause incorrect pipapo set width calculations.

Vulnerability

Overview

CVE-2025-21826 is a flaw in the Linux kernel's netfilter subsystem, specifically within nf_tables. The issue arises when the sum of field length descriptions does not match the set key length. The field length description specifies the length of each separated key field in a concatenation, and each field is rounded up to 32 bits to compute the pipapo rule width via pipapo_init(). However, register-based arithmetic can still allow a set key length that mismatches the field description, leading to an incorrect pipapo width calculation [1].

Exploitation

Conditions

To exploit this vulnerability, an attacker would need the ability to craft and install netfilter rules with a mismatching set key length and field description. This requires sufficient privileges to interact with the nf_tables subsystem, typically root or CAP_NET_ADMIN capabilities. The attack surface is local, as the netfilter subsystem is accessible only from within the Linux kernel namespace where the attacker has such privileges [1].

Impact

A successful exploitation could lead to a system crash (denial of service) due to incorrect memory calculations or other undefined behavior stemming from the mismatched width. The CVSS v3 base score of 5.5 (Medium) reflects the potential for a local denial-of-service impact with low attack complexity [1].

Mitigation

The fix is included in the Linux kernel stable releases accessible via commits [3][4]. For affected embedded systems, such as the Siemens SIMATIC S7-1500 TM MFP's GNU/Linux subsystem, users should apply the kernel update or vendor-provided patches. The Siemens advisory notes that all versions of this subsystem are affected and recommends general security measures [1].

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

78

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.