Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE
Affects Linux kernels from 2.6.19-rc1 onward when IPT_SO_SET_REPLACE or IP6T_SO_SET_REPLACE runs in compat mode. Fixed in 5.10.31, 5.4.113, 4.19.188, 4.14.231, 4.9.267 and 4.4.267.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 5.10.31, 5.4.113, 4.19.188, 4.14.231, 4.9.267, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Linux kernel's Netfilter x_tables component, which handles IPv6 packet filtering rules, is affected by this flaw. An attacker could exploit it through user namespaces to gain elevated privileges or crash the system by corrupting heap memory.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a Linux Kernel
From 2.6.19-rc1 · fixed in unspecified
References 9
GitHub · google/security-research
git.kernel.org
packetstormsecurity.com
- files/163528/Linux-Kernel-Netfilter-Heap-Out-Of-Bounds-Write.html
- files/163878/Kernel-Live-Patch-Security-Notice-LSN-0080-1.html
- files/164155/Kernel-Live-Patch-Security-Notice-LSN-0081-1.html
- files/164437/Netfilter-x_tables-Heap-Out-Of-Bounds-Write-Privilege-Escalation.html
- files/165477/Kernel-Live-Patch-Security-Notice-LSN-0083-1.html
security.netapp.com
Questions about CVE-2021-22555
What does this mean?
A heap out-of-bounds write in the Netfilter IP6T_SO_SET_REPLACE code corrupts heap memory. Per the advisory, local users can use it to gain privileges or cause a denial of service via a user namespace.Source: github.com
Am I affected, and how do I check?
Linux kernel versions from 2.6.19-rc1 onward are affected when IPT_SO_SET_REPLACE or IP6T_SO_SET_REPLACE is called in compat mode. Check the kernel version with uname -r; the facts give no setting for compat mode.Source: github.com
What should I do about it?
Move to a fixed stable release on the matching branch: 5.10.31, 5.4.113, 4.19.188, 4.14.231, 4.9.267 or 4.4.267. The facts list no workaround.Source: github.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-10-06, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data