CVE-2021-22555

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Oct 13, 2026

Description

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Jul 7, 2021
Last modified: Oct 13, 2026
Added to CISA KEV: Oct 6, 2025
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-225567.8The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operatio CVE-2021-225577.8SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the S CVE-2021-225610.0Vulnerability in the Oracle Storage Cloud Software Appliance product of Oracle Storage Gateway (component: Management Console). The supporte CVE-2021-225634.4Invalid JPEG XL images using libjxl can cause an out of bounds access on a std::vector<std::vector<T>> when rendering splines. The OOB read CVE-2021-225645.5For certain valid JPEG XL images with a size slightly larger than an integer number of groups (256x256 pixels) when processing the groups ou CVE-2021-225656.5An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs CVE-2021-225669.8An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as executable from an unpr CVE-2021-225673.5Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefariou CVE-2021-225688.8When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oau CVE-2021-225695.5An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out o CVE-2021-22574.1Vulnerability in the Oracle Storage Cloud Software Appliance product of Oracle Storage Gateway (component: Management Console). The supporte CVE-2021-225705.5Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the p