CVE-2021-22555: Linux kernel netfilter x_tables heap out-of-bounds write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with a very high EPSS score and public exploit code, but exploitation requires local low-privileged access rather than being remotely reachable.

What it is

A heap out-of-bounds write exists in the Linux kernel netfilter x_tables code (net/netfilter/x_tables.c), present since v2.6.19-rc1. A local attacker can corrupt heap memory through a user namespace, leading to privilege escalation or denial of service. The flaw is remotely relevant only in the sense that it is a widely deployed kernel component, but exploitation itself is local.

Impact

An attacker gains kernel-level heap corruption that can be turned into privilege escalation to root, or used to crash the system for denial of service.

Attack surface

Reached locally via the netfilter/x_tables interface, requiring a low-privileged local account and user namespace access; no user interaction is needed. The CVSS vector is AV:L/AC:L/PR:L/UI:N, confirming local, low-complexity, authenticated access.

Exploitation

CVE-2021-22555 is listed in CISA KEV (added 2025-10-06, due 2025-10-27) and has a high EPSS 30-day probability of 0.78684 (99.566th percentile). Multiple references are tagged Exploit, including public proof-of-concept and kernel live-patch notices, so working exploit code is publicly available.

What to do

• Apply the upstream kernel patches referenced in the git.kernel.org commits for net/netfilter/x_tables.c, or update to a vendor kernel that includes them.
• For NetApp, Brocade and other listed products, apply the vendor advisories (e.g. NetApp ntap-20210805-0010) or discontinue use if no fix is available, per CISA KEV required action.
• Restrict unprivileged user namespace creation (e.g. kernel.unprivileged_userns_clone=0 or equivalent) where the workload allows, to reduce the attack surface.
• Limit local shell access and enforce least privilege so untrusted users cannot reach the vulnerable netfilter code path.
• Track the CISA KEV due date of 2025-10-27 and prioritize remediation of internet-facing or multi-tenant hosts first.

Detection

• Monitor for unexpected privilege escalation or setuid/root shell spawning from low-privileged processes on Linux hosts.
• Audit kernel logs and crash dumps for netfilter/x_tables related heap corruption, slab errors or general protection faults.
• Watch for creation of unprivileged user namespaces and unusual netfilter/iptables rule manipulation by non-root users.
• Use host-based EDR or auditd rules to alert on execution of known public exploit binaries targeting CVE-2021-22555.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.