{"id":"CVE-2025-22021","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: socket: Lookup orig tuple for IPv6 SNAT\n\nnf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to\nrestore the original 5-tuple in case of SNAT, to …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: socket: Lookup orig tuple for IPv6 SNAT\n\nnf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to\nrestore the original 5-tuple in case of SNAT, to …","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 3.13, < 5.4.292","linux_kernel >= 5.5, < 5.10.236","linux_kernel >= 5.11, < 5.15.180","linux_kernel >= 5.16, < 6.1.133","linux_kernel >= 6.2, < 6.6.86","linux_kernel >= 6.7, < 6.12.22","linux_kernel >= 6.13, < 6.13.10","linux_kernel = 6.14"],"patched":["linux_kernel 6.13.10"],"published":"2025-04-16","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:18:13.463","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-22021","references":[{"url":"https://git.kernel.org/stable/c/1ca2169cc19dca893c7aae6af122852097435d16","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1ec43100f7123010730b7ddfc3d5c2eac19e70e7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/221c27259324ec1404f028d4f5a0f2ae7f63ee23","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2bb139e483f8cbe488d19d8c1135ac3615e2668c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/41904cbb343d115931d6bf79aa2c815cac4ef72b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5251041573850e5020cd447374e23010be698898","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/58ab63d3ded2ca6141357a2b24eee8453d0f871d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6488b96a79a26e19100ad872622f04e93b638d7f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/932b32ffd7604fb00b5c57e239a3cc4d901ccf6e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"epss":0.00471,"epssPercentile":0.40544,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-15T21:44:08.710452Z"},"ingestedAt":"2026-10-15T22:48:25.472Z","slug":"CVE-2025-22021","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: socket: Lookup orig tuple for IPv6 SNAT\n\nnf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to\nrestore the original 5-tuple in case of SNAT, to be able to find the\nright socket (if any). Then socket_match() can correctly check whether\nthe socket was transparent.\n\nHowever, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this\nconntrack lookup, making xt_socket fail to match on the socket when the\npacket was SNATed. Add the same logic to nf_sk_lookup_slow_v6.\n\nIPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as\npods' addresses are in the fd00::/8 ULA subnet and need to be replaced\nwith the node's external address. Cilium leverages Envoy to enforce L7\npolicies, and Envoy uses transparent sockets. Cilium inserts an iptables\nprerouting rule that matches on `-m socket --transparent` and redirects\nthe packets to localhost, but it fails to match SNATed IPv6 packets due\nto that missing conntrack lookup.\n\n## Affected\n\n- `linux_kernel >= 3.13, < 5.4.292`\n- `linux_kernel >= 5.5, < 5.10.236`\n- `linux_kernel >= 5.11, < 5.15.180`\n- `linux_kernel >= 5.16, < 6.1.133`\n- `linux_kernel >= 6.2, < 6.6.86`\n- `linux_kernel >= 6.7, < 6.12.22`\n- `linux_kernel >= 6.13, < 6.13.10`\n- `linux_kernel = 6.14`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.13.10`","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":55,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}