IPv6 SNAT Vulnerability in Linux Kernel Affecting Network Traffic Management

CVE-2025-22021

Summary

This vulnerability exists due to a missing connection tracking mechanism in the IPv6 SNAT implementation within the Linux kernel. Specifically, while the process for IPv4 packets correctly restores the original 5-tuple during SNAT operations, the corresponding logic for IPv6 packets currently lacks adequate conntrack lookup. This deficiency leads to failures in matching SNATed IPv6 packets when using tools like Cilium and Envoy, particularly in Kubernetes environments. As a result, packets might not be correctly processed, hindering effective network traffic management and policy enforcement.

References