{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-22021",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-22021",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-04-16T10:20:37.695Z",
    "updatedAt": "2026-10-15T21:51:56.689Z",
    "importedAt": "2026-10-24T01:57:29.455Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "netfilter: socket: Lookup orig tuple for IPv6 SNAT",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: socket: Lookup orig tuple for IPv6 SNAT\n\nnf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to\nrestore the original 5-tuple in case of SNAT, to be able to find the\nright socket (if any). Then socket_match() can correctly check whether\nthe socket was transparent.\n\nHowever, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this\nconntrack lookup, making xt_socket fail to match on the socket when the\npacket was SNATed. Add the same logic to nf_sk_lookup_slow_v6.\n\nIPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as\npods' addresses are in the fd00::/8 ULA subnet and need to be replaced\nwith the node's external address. Cilium leverages Envoy to enforce L7\npolicies, and Envoy uses transparent sockets. Cilium inserts an iptables\nprerouting rule that matches on `-m socket --transparent` and redirects\nthe packets to localhost, but it fails to match SNATed IPv6 packets due\nto that missing conntrack lookup.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "status": "affected",
              "versionType": "git",
              "lessThan": "6488b96a79a26e19100ad872622f04e93b638d7f"
            },
            {
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "status": "affected",
              "versionType": "git",
              "lessThan": "58ab63d3ded2ca6141357a2b24eee8453d0f871d"
            },
            {
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "status": "affected",
              "versionType": "git",
              "lessThan": "1ca2169cc19dca893c7aae6af122852097435d16"
            },
            {
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "status": "affected",
              "versionType": "git",
              "lessThan": "1ec43100f7123010730b7ddfc3d5c2eac19e70e7"
            },
            {
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "status": "affected",
              "versionType": "git",
              "lessThan": "5251041573850e5020cd447374e23010be698898"
            },
            {
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "status": "affected",
              "versionType": "git",
              "lessThan": "2bb139e483f8cbe488d19d8c1135ac3615e2668c"
            },
            {
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "status": "affected",
              "versionType": "git",
              "lessThan": "41904cbb343d115931d6bf79aa2c815cac4ef72b"
            },
            {
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "status": "affected",
              "versionType": "git",
              "lessThan": "221c27259324ec1404f028d4f5a0f2ae7f63ee23"
            },
            {
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "status": "affected",
              "versionType": "git",
              "lessThan": "932b32ffd7604fb00b5c57e239a3cc4d901ccf6e"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "3.13",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "3.13"
            },
            {
              "version": "5.4.292",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "version": "5.10.236",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "version": "5.15.180",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "6.1.133",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.86",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.22",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.13.10",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.13.*"
            },
            {
              "version": "6.14.1",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.14.*"
            },
            {
              "version": "6.15",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}