CVE-2025-22021

What it actually does

nf_sk_lookup_slow_v6 skips the conntrack lookup that restores the original 5-tuple after IPv6 SNAT, so xt_socket cannot correctly identify whether a socket is transparent.

Why it matters to the business

In container environments using IPv6, security policies enforced through transparent sockets may be bypassed for outbound pod traffic, weakening network controls and increasing exposure to unauthorized communication.

How an attack unfolds

An attacker generates IPv6 traffic from a pod that undergoes SNAT; because the missing conntrack step prevents proper socket matching, any iptables or nftables rules relying on -m socket --transparent fail to redirect or inspect the packets, allowing the traffic to reach its destination without L7 policy enforcement.

How to fix it

Upgrade the Linux kernel to a version containing commit 6488b96a79a26e19100ad872622f04e93b638d7f or later; rebuild and redeploy any affected container host images; verify that Cilium or equivalent networking components pick up the corrected nf_sk_lookup_slow_v6 behavior.

How to confirm the fix worked

Confirm the kernel contains the referenced commit, then test that IPv6 SNATed packets now correctly match xt_socket rules by checking that prerouting redirects occur as expected for transparent sockets.

Typical attack path

1. Establish IPv6 connectivity from a container whose address is in the ULA range
2. Trigger SNAT so the packet leaves with the node's external address
3. Send traffic that should be intercepted by transparent-socket rules
4. Observe that the expected redirection or policy check does not occur

How to detect it

Search kernel and netfilter logs for IPv6 SNAT events paired with xt_socket misses; examine iptables/nftables rule counters on prerouting chains that use socket matching; look for unexpected direct egress from pods that should have been redirected.

What your security team should do

• Prioritize kernel updates on all IPv6-enabled Kubernetes nodes within the next maintenance window
• Review Cilium/Envoy L7 policy coverage for IPv6 pod-to-world traffic
• Add runtime checks that verify socket-match behavior after upgrades