Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🛡️
CISA KEV · ACTIVELY EXPLOITED
HIGH severity

CVE-2021-22555 — Linux kernel

HIGH

CVE-2021-22555 is a high-severity (CVSS 7.8) Out-of-bounds Write vulnerability. It is in CISA's Known Exploited Vulnerabilities catalog (added 2025-10-06) — treat it as actively exploited and patch now. No vendor fix is recorded yet; mitigation options are listed below.

Also known asA-184847809PUB-A-184847809
Published
Updated
Affected
21 products
Patched
See advisory
Exploits
17 known
Exploitation data as of Oct 24, 2026 · OSV.dev, NVD, CISA KEV, FIRST.org (EPSS)

Exploitation Status

Actively exploited in the wild

  • Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2025-10-06. Federal agencies were required to remediate by 2025-10-27.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA (KEV catalog and SSVC triage) for CVE-2021-22555.

EPSS Exploitation Probability

via FIRST.org ↗
78.7%probability of exploitation in next 30 days
Very High Risk0.00%
Lower risk than most CVEs100th percentile — riskier than 100% of all scored CVEsHighest risk
76.4%80.5%84.5%88.6%85.2%78.7%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2021-22555 by exploitation likelihood (EPSS) against impact (CVSS). In the shaded patch-first corner (EPSS 50%+, CVSS 7.0+).

Where this sits among everything scored

Of 395,249 CVEs with a current EPSS score, this one falls in the 50–90% band (highlighted). Counts from FIRST.org, log-scaled.

Description

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space

Affected Products

21 products · 27 configurations
OS
fabric operating systembroadcom
all
OS
linux kernellinux
≥ 5.11 && < 5.12
range
OS
aff 500f firmwarenetapp
all
OS
aff a250 firmwarenetapp
all
OS
aff a400 firmwarenetapp
all
OS
c250 firmwarenetapp
all
Exploits & PoCs
17

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

EDB-50135locallinux✓ Verified

Linux Kernel 2.6.19 < 5.9 - 'Netfilter Local Privilege Escalation

by TheFloW · Jul 15, 2021

Exploit-DB Source

Detection & mitigation playbook

Vulnerability

  1. Detect

    Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).

  2. Remediation status

    No fixed release is recorded for CVE-2021-22555 yet. Track the upstream advisory, and apply the exposure-reduction steps below in the meantime.

  3. Mitigate without a patch

    Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

In Red Hat Enterprise Linux 7, only privileged users can trigger this bug. In Red Hat Enterprise Linux 8 a regular user can trigger it, however the result is corruption of 4 bytes of memory.

Workaround published by Red Hat
The mitigation for the Red Hat Enterprise Linux 8 is to disable unprivileged users from running unshare(CLONE_NEWUSER) or unshare(CLONE_NEWNET) that could be done with this command: echo 0 > /proc/sys/user/max_user_namespaces For making this change in configuration permanent. Note: User namespaces are used primarily for Linux containers. If containers are in use, this requirement is not applicable. Configure RHEL 8 to disable the use of user namespaces by adding the following line to a file in the "/etc/sysctl.d/" directory: user.max_user_namespaces = 0 The system configuration files need to be reloaded for the changes to take effect. To reload the contents of the files, run the following…
Source: Red Hat security advisory for CVE-2021-22555 (CC BY 4.0)
ProductFixed inAdvisory
Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSIONkernel-0:2.6.32-754.58.1.el6RHSA-2025:17733
Red Hat Enterprise Linux 7kernel-rt-0:3.10.0-1160.41.1.rt56.1181.el7RHSA-2021:3328
Red Hat Enterprise Linux 7kernel-0:3.10.0-1160.41.1.el7RHSA-2021:3327
Red Hat Enterprise Linux 7kpatch-patchRHSA-2021:3381
Red Hat Enterprise Linux 7.2 Advanced Update Supportkernel-0:3.10.0-327.100.1.el7RHSA-2021:3399
Red Hat Enterprise Linux 7.3 Advanced Update Supportkernel-0:3.10.0-514.92.1.el7RHSA-2021:3321
Red Hat Enterprise Linux 7.4 Advanced Update Supportkernel-0:3.10.0-693.94.1.el7RHSA-2021:3725
Red Hat Enterprise Linux 7.6 Advanced Update Supportkernel-0:3.10.0-957.84.1.el7RHSA-2021:3812
UbuntuHIGH
USN-5039-1UbuntuLSN-0080-1UbuntuLSN-0081-1UbuntuLSN-0083-1Ubuntu

Frequently Asked Questions

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space
O3 Security · Impact-Aware SCA

Is CVE-2021-22555 in your dependencies?

Find it across , including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2021-22555: Linux kernel Memory Corruption (KEV)