High 7.8Published Mar 6, 2025

CVE-2025-21826netfilter: nf_tables: reject mismatching sum of field_len with set key length

Updated under an hour ago (Oct 28, 2026, 4:10 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject mismatching sum of field_len with set key length The field length description provides the length of each separated key field in the concatenation, each field gets rounded up to 32-bits to calculate the pipapo rule width from pipapo_init(). The set key length provides the total size of the key aligned to 32-bits. Register-based arithmetics still allows for combining mismatching set key length and field length description, eg. set key length 10 and field description [ 5, 4 ] leading to pipapo width of 12.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Not yet received
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 2d4c0798a1ef8db15b3277697ac2def4eda42312 before 6b467c8feac759f4c5c86d708beca2aa2b29584f; from 77be8c495a3f841e88b46508cc20d3d7d3289da3 before 5083a7ae45003456c253e981b30a43f71230b4a3; 9cb084df01e198119de477ac691d682fb01e80f3 builds before 2ac254343d3cf228ae0738b2615fedf85d000752; from dc45bb00e66a33de1abb29e3d587880e1d4d9a7e before 82e491e085719068179ff6a5466b7387cc4bbf32; from 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 before 49b7182b97bafbd5645414aff054b4a65d05823d; from 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 before ab50d0eff4a939d20c37721fd9766347efcdb6f6; 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 builds before 1b9335a8000fb70742f7db10af314104b6ace220; ff67e3e488090908dc015ba04d7407d8bd467f7e; and 5 more ranges	CNA record
Siemens SIMATIC S7-1500 TM MFP - BIOS siemens:simatic_s7_1500_tm_mfp_bios (from the name)	all versions	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP

References

References

https://git.kernel.org/stable/c/6b467c8feac759f4c5c86d708beca2aa2b29584f
https://git.kernel.org/stable/c/5083a7ae45003456c253e981b30a43f71230b4a3
https://git.kernel.org/stable/c/2ac254343d3cf228ae0738b2615fedf85d000752
https://git.kernel.org/stable/c/82e491e085719068179ff6a5466b7387cc4bbf32
https://git.kernel.org/stable/c/49b7182b97bafbd5645414aff054b4a65d05823d
https://git.kernel.org/stable/c/ab50d0eff4a939d20c37721fd9766347efcdb6f6
https://git.kernel.org/stable/c/1b9335a8000fb70742f7db10af314104b6ace220

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.