CVE-2021-22555: Linux Kernel Heap Out-of-Bounds Write Vulnerability

KEV

Analyzed

AliasesRHSA-2025:17733LSN-0080-1UBUNTU-CVE-2021-22555+2 more

Published 07-07-2021Last modified 30-12-2025

Vulnerability summary

CVE-2021-22555 is a high (CVSS 8.3) Out-of-bounds Write vulnerability in Linux Kernel. It is known to be exploited: CISA lists it, first on 06-10-2025. EPSS estimates a 78.68% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 7 public exploits are recorded.

Priority

Act nowlisted as exploited

Listed as exploited by CISA (06-10-2025)

Source freshness unavailable

How is this decided?

CVSS score

8.3/10

010

High · v3.1 (CVE.org)

EPSS score

78.68%

0%100%

Critical · 0.00 pp in 30 days

KEVExploited in the wildCritical · listed in 1 catalog

RansomwareNot flaggedNo ransomware use recorded.

Public exploits7github, reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 47 · Related 25

Timeline

07-07-2021
PublishedVulnerability first disclosed.
06-10-2025
Added to CISA KEVExploitedLinux Kernel Heap Out-of-Bounds Write Vulnerability
27-10-2025
CISA remediation dueDeadline passedApply mitigations per vendor instructions.
30-12-2025
Last modifiedVulnerability information updated.

Description

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space

CVSS metrics

6 scores · 5 sources · 2 versions

v3.18.3v2.04.6

EPSS trend

Probability

78.68%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 78.68% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 06-10-2025
Federal due date: 27-10-2025

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. git.kernel.org/pub/… git.kernel.org/pub/… security.netapp.com/advisory/ntap-20210805-0010/ github.com/google/security-research/security/advisories/GHSA-xxx5-8mvq-3528 nvd.nist.gov/vuln/detail/CVE-2021-22555

Public exploits

7 found

githubUnverified
Security Research
Maturity: poc
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown

Show all 7 exploits

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
exploit-databaselocallinuxVerified
Linux Kernel 2.6.19 < 5.9 - 'Netfilter Local Privilege Escalation
Maturity: weaponized
MetasploitremoteVerified
Netfilter x_tables Heap OOB Write Privilege Escalation
exploit/linux/local/netfilter_xtables_heap_oob_write_priv_esc
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.

Affected systems

Version check

Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu49 products

linux< 4.15.0-144.148 | < 5.4.0-74.83 | < 3.13.0-187.238 | < 4.4.0-213.245
linux-aws< 4.15.0-1103.110 | < 5.4.0-1049.51 | < 4.4.0-1095.100 | < 4.4.0-1131.145
linux-aws-5.0All versions (No fix recorded)
linux-aws-5.3All versions (No fix recorded)
linux-aws-5.4< 5.4.0-1049.51~18.04.1

linux-aws-fips< 4.15.0-2045.47 | All versions (No fix recorded) | < 5.4.0-1069.73+fips2
linux-aws-hwe< 4.15.0-1103.110~16.04.1
linux-azure< 4.15.0-1115.128~14.04.1 | < 4.15.0-1115.128~16.04.1 | All versions (No fix recorded) | < 5.4.0-1048.50
linux-azure-4.15< 4.15.0-1115.128
linux-azure-5.3All versions (No fix recorded)
linux-azure-5.4< 5.4.0-1048.50~18.04.1
linux-azure-edgeAll versions (No fix recorded)
linux-azure-fips< 4.15.0-2027.30 | All versions (No fix recorded) | < 5.4.0-1073.76+fips1
linux-bluefield< 5.4.0-1012.15
linux-dell300x< 4.15.0-1022.26
linux-fips< 4.4.0-1065.71 | All versions (No fix recorded) | < 4.15.0-1060.68
linux-gcp< 5.4.0-1044.47 | < 4.15.0-1100.113~16.04.1 | All versions (No fix recorded)
linux-gcp-4.15< 4.15.0-1100.113
linux-gcp-5.3All versions (No fix recorded)
linux-gcp-5.4< 5.4.0-1044.47~18.04.2
linux-gcp-edgeAll versions (No fix recorded)
linux-gcp-fipsAll versions (No fix recorded) | < 5.4.0-1067.71~20.04.1
linux-gke< 5.4.0-1044.46
linux-gke-4.15All versions (No fix recorded)
linux-gke-5.4< 5.4.0-1044.46~18.04.1
linux-gkeop< 5.4.0-1016.17
linux-gkeop-5.4< 5.4.0-1016.17~18.04.1
linux-hwe< 4.15.0-144.148~16.04.1 | All versions (No fix recorded)
linux-hwe-5.4< 5.4.0-74.83~18.04.1
linux-hwe-5.8< 5.8.0-55.62~20.04.1
linux-hwe-edgeAll versions (No fix recorded)
linux-intel-iot-realtimeAll versions (No fix recorded)
linux-kvm< 4.15.0-1092.94 | < 5.4.0-1040.41 | < 4.4.0-1096.105
linux-lts-xenial< 4.4.0-213.245~14.04.1
linux-oemAll versions (No fix recorded)
linux-oem-5.10< 5.10.0-1025.26
linux-oem-5.6All versions (No fix recorded)
linux-oracle< 4.15.0-1072.80~16.04.1 | < 4.15.0-1072.80 | < 5.4.0-1046.50
linux-oracle-5.0All versions (No fix recorded)
linux-oracle-5.3All versions (No fix recorded)
linux-oracle-5.4< 5.4.0-1046.50~18.04.2
linux-raspi< 5.4.0-1036.39
linux-raspi-5.4< 5.4.0-1036.39~18.04.1
linux-raspi-realtimeAll versions (No fix recorded)
linux-raspi2< 4.15.0-1086.91 | All versions (No fix recorded)
linux-realtimeAll versions (No fix recorded)
linux-riscvAll versions (No fix recorded)
linux-riscv-5.8< 5.8.0-26.28~20.04.1
linux-snapdragon< 4.15.0-1103.112