CVE-2025-21826

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: reject mismatching sum of field_len with set key length

The field length description provides the length of each separated key field in the concatenation, each field gets rounded up to 32-bits to calculate the pipapo rule width from pipapo_init(). The set key length provides the total size of the key aligned to 32-bits.

Register-based arithmetics still allows for combining mismatching set key length and field length description, eg. set key length 10 and field description [ 5, 4 ] leading to pipapo width of 12.

This vulnerability is rated as Moderate severity because exploitation requires local access with administrative network configuration capabilities (CAP_NET_ADMIN) or access to unprivileged user namespaces. A local attacker can trigger this flaw by submitting concatenated key sets with mismatched field lengths in the nf_tables subsystem, potentially resulting in kernel memory corruption and a denial of service. Systems where untrusted users cannot create unprivileged user namespaces or do not hold administrative network permissions are not exposed to unprivileged exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.