Linux Kernel Heap Out-of-Bounds Write Vulnerability
Exploited since 2025-10-06. No WAF vendor names it yet.
A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space
Edge coverage
Claimed by vendorsAsk Vigil
AI · answers from this pageWorkers AI (Llama 3.3). Can be wrong: check the cited source.
Severity, decoded
CVSS 3.1Exploitable from an adjacent network under specific conditions, with no privileges and no user interaction, leading to full loss of confidentiality, integrity and availability, and the impact can reach components beyond the vulnerable one.
How the score is built
- Attack vectorAn attacker must be on the same local network, Wi-Fi or VPN segment.Adjacent network
- Attack complexityThe attack only works when conditions outside the attacker's control line up.High
- Privileges requiredNo account or login is needed.None
- User interactionNo one has to click or open anything; the attack works on its own.None
- ScopeThe attack can spread beyond the vulnerable component to other parts of the system.Changed
- Confidentiality impactAn attacker can read all data the affected component holds, or the most sensitive parts of it.High
- Integrity impactAn attacker can change any data or files the affected component protects.High
- Availability impactAn attacker can take the component down completely or keep it from serving anyone.High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HAttackers are exploiting this in the wild.
At least one step needs hands-on work, which slows mass attacks.
A successful attack gives full control over the affected software or all of its data.
Public exploits
2 found- MetasploitNetfilter x_tables Heap OOB Write Privilege Escalation2021-07-07 · exploit · rank Great · has check
- Exploit-DBLinux Kernel 2.6.19 < 5.9 - 'Netfilter Local Privilege Escalation2021-07-15 · local · linux · verified
Links are to third-party code: never run it outside an isolated lab.
Timeline
- 2021-07-07CVE publishedCVE List
- 2021-07-07Metasploit module publishedNetfilter x_tables Heap OOB Write Privilege Escalation
- 2021-07-15Exploit published on Exploit-DBLinux Kernel 2.6.19 < 5.9 - 'Netfilter Local Privilege Escalation
- 2025-10-06Added to CISA KEVConfirmed exploitation in the wild
Vendor statements
QuotedCloudflareWAF Managed Rules
The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.
AWSAWS WAF Managed Rules
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. AWS often describes a vulnerability without naming its CVE (for example "Log4j"). We count only entries that name the CVE, so AWS coverage is understated.
Microsoft AzureFront Door and Application Gateway WAF (DRS)
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. The rule tables name CVEs but carry no dates, so Azure is left out of every time-to-rule figure.
Google CloudCloud Armor preconfigured WAF rules
The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.
FastlyNext-Gen WAF virtual patches
The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.
F5Attack signatures (Distributed Cloud WAF)
The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.
AkamaiApp & API Protector (Adaptive Security Engine)
This vendor publishes no machine-readable rule changelog we can check.
OWASP CRSCore Rule Set (open source, used inside many WAFs)
The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.
Social
No posts seen yet on X, Bluesky, Mastodon, Hacker News or GitHub.