CVE-2021-22555

HIGH KEV LAB

Netfilter x_tables Heap OOB Write Privilege Escalation

Title source: metasploit
STIX 2.1

Exploitation Summary

CVE-2021-22555 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added October 6, 2025. EIP tracks 16 public exploits from researchers including TheFloW, veritas501, xyjl-ly, including a Metasploit module exploits/linux/local/netfilter_xtables_heap_oob_write_priv_esc.

AI-analyzed exploit summary This exploit leverages an out-of-bounds write vulnerability in the Linux kernel's netfilter subsystem (CVE-2021-22555) to achieve local privilege escalation. It uses a combination of heap spraying, memory corruption, and SMAP/KASLR bypass techniques to gain root privileges.

Description

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space

Exploits (16)

exploitdb WORKING POC VERIFIED
by TheFloW · clocallinux
https://www.exploit-db.com/exploits/50135

This exploit leverages an out-of-bounds write vulnerability in the Linux kernel's netfilter subsystem (CVE-2021-22555) to achieve local privilege escalation. It uses a combination of heap spraying, memory corruption, and SMAP/KASLR bypass techniques to gain root privileges.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel versions 5.4.89+ (COS) and 5.8.0-48-generic (Ubuntu)
No auth needed
Prerequisites: Local access to a vulnerable Linux system · Compilation environment with gcc
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 37 stars
by veritas501 · local
https://github.com/veritas501/CVE-2021-22555-PipeVersion

This repository contains a functional exploit for CVE-2021-22555, leveraging a pipe-primitive technique to bypass KASLR, SMAP, SMEP, and KPTI. The exploit targets a memory corruption vulnerability in the Linux kernel, specifically manipulating message queues and pipe buffers to achieve local privilege escalation (LPE).

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (tested on 4.15 and 5.8)
No auth needed
Prerequisites: Local access to a vulnerable Linux system · Compilation environment with GCC
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 13 stars
by xyjl-ly · local
https://github.com/xyjl-ly/CVE-2021-22555-Exploit

This repository contains a functional exploit for CVE-2021-22555, a heap out-of-bounds write vulnerability in the Linux kernel's netfilter subsystem. The exploit demonstrates privilege escalation by leveraging memory corruption, SMAP bypass, KASLR bypass, and ultimately executing arbitrary kernel code to gain root privileges.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (versions 2.6.19-rc1 to 5.12-rc4)
No auth needed
Prerequisites: User namespace access · Linux kernel version within vulnerable range
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 4 stars
by cgwalters · poc
https://github.com/cgwalters/container-cve-2021-22555

This repository contains a functional exploit for CVE-2021-22555, a Linux kernel privilege escalation vulnerability. It includes a Dockerized exploit, a seccomp mitigation profile, and detailed documentation on the vulnerability and mitigation strategies.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux Kernel (tested on Ubuntu 5.8.0-48-generic and COS 5.4.89+)
No auth needed
Prerequisites: Linux system with vulnerable kernel · Ability to execute binary
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 3 stars
by tukru · local
https://github.com/tukru/CVE-2021-22555

This repository contains a functional Linux privilege escalation exploit for CVE-2021-22555, leveraging memory corruption in the Linux kernel to escalate privileges. The exploit demonstrates a multi-stage attack involving memory spraying, SMAP bypass, KASLR bypass, and kernel code execution to gain root access.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (tested on Ubuntu 5.8.0-48-generic and COS 5.4.89+)
No auth needed
Prerequisites: Vulnerable Linux kernel · Basic knowledge of C and Linux system programming
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by Spydomain · local
https://github.com/Spydomain/CVE-2021-22555-Poc

This repository contains a functional exploit for CVE-2021-22555, a heap overflow vulnerability in the Linux kernel's netfilter subsystem. The exploit leverages a heap out-of-bounds write to achieve privilege escalation to root on Ubuntu 20.04 with kernel 5.8.0-48-generic.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel 5.8.0-48-generic (Ubuntu 20.04)
No auth needed
Prerequisites: Ubuntu 20.04 with kernel 5.8.0-48-generic · Compilation tools (gcc, build-essential) · ip_tables kernel module loaded
devstral-2 · analyzed Mar 06, 2026 Full analysis →
nomisec WORKING POC 1 stars
by masjohncook · infoleak
https://github.com/masjohncook/netsec-project

This repository contains a Python-based exploit for CVE-2021-22555, which automates the attack process including host discovery, port scanning, SSH brute-forcing, and exploit execution. The script leverages Metasploit's RPC interface to establish a shell session and deliver the exploit payload.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Ubuntu 20.04 with kernel version 5.8.0-48
No auth needed
Prerequisites: Target IP address · Metasploit RPC server running · User and password wordlists
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec NO CODE 1 stars
by JoneyJunior · poc
https://github.com/JoneyJunior/cve-2021-22555
nomisec WORKING POC
by glutton-su · local
https://github.com/glutton-su/CVE-2021-22555

This repository contains a functional exploit for CVE-2021-22555, a Linux kernel vulnerability in the netfilter subsystem. The exploit demonstrates a local privilege escalation (LPE) by leveraging memory corruption, SMAP bypass, KASLR bypass, and ultimately achieving root privileges.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (5.11.14)
No auth needed
Prerequisites: Linux kernel version 5.11.14 · Local user access
devstral-2 · analyzed Feb 25, 2026 Full analysis →
gitlab WORKING POC
by iwienand · poc
https://gitlab.com/iwienand/cve-2021-22555

This repository contains a functional proof-of-concept exploit for CVE-2021-22555, a vulnerability in the Linux kernel's netfilter subsystem. The exploit triggers an out-of-bounds write in kmalloc-512 by manipulating ip6_tables structures via setsockopt, demonstrating the vulnerability in a controlled manner.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (netfilter/ip6_tables)
No auth needed
Prerequisites: Linux system with ip6_tables module loaded · CAP_NET_ADMIN capabilities or root access
devstral-2 · analyzed Feb 23, 2026 Full analysis →
nomisec WORKING POC
by letsr00t · local
https://github.com/letsr00t/CVE-2021-22555

This repository contains a functional exploit for CVE-2021-22555, a Linux kernel vulnerability that allows local privilege escalation (LPE) via memory corruption in the netfilter subsystem. The exploit demonstrates a multi-stage attack involving heap spraying, SMAP/KASLR bypass, and ROP chain execution to gain root privileges.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (Ubuntu 5.8.0-48-generic and COS 5.4.89+)
No auth needed
Prerequisites: Local access to a vulnerable Linux system · Compilation environment for 32-bit static binary
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by pashayogi · local
https://github.com/pashayogi/CVE-2021-22555

This repository contains a functional exploit for CVE-2021-22555, a Linux kernel Netfilter local privilege escalation vulnerability. The exploit leverages memory corruption, SMAP bypass, KASLR bypass, and kernel code execution to escalate privileges to root.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux Kernel 2.6.19 < 5.9
No auth needed
Prerequisites: Access to a vulnerable Linux kernel version · Ability to compile and execute the exploit
devstral-2 · analyzed Feb 18, 2026 Full analysis →
vulncheck_xdb WORKING POC
local
https://github.com/LingerANR/CVE-2021-22-555

This is a functional local privilege escalation exploit for CVE-2021-22555, targeting a memory corruption vulnerability in the Linux kernel's netfilter subsystem. The exploit uses a multi-stage approach involving message queue manipulation, heap spraying, and kernel address leakage to achieve arbitrary kernel code execution and root privileges.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (tested on Ubuntu 5.8.0-48-generic and COS 5.4.89+)
No auth needed
Prerequisites: Linux system with vulnerable kernel · unprivileged user access · namespace and message queue permissions
devstral-2 · analyzed Feb 25, 2026 Full analysis →
metasploit WORKING POC GREAT
by Andy Nguyen (theflow@), Szymon Janusz, bcoles · rubypoclinux
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/netfilter_xtables_heap_oob_write_priv_esc.rb

This Metasploit module exploits a heap out-of-bounds write vulnerability in the Linux kernel's netfilter x_tables (CVE-2021-22555) to achieve local privilege escalation. It targets Ubuntu kernels and requires specific conditions, such as a minimum message queue size (MSGMNI).

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel (up to 5.11) with netfilter x_tables
No auth needed
Prerequisites: ip_tables kernel module loaded · MSGMNI >= 4096 · writable directory on target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (10)

Core 10
Core References
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20210805-0010/

Scores

CVSS v3 8.3
EPSS 0.8524
EPSS Percentile 99.4%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Lab Environment

COMMUNITY
Community Lab
docker pull registry.redhat.io/rhel8/gcc-toolset-10-toolchain
+11 more repos

Details

CISA KEV 2025-10-06
VulnCheck KEV 2024-03-18
ENISA EUVD EUVD-2021-9696
CWE
CWE-787
Status published
Products (21)
brocade/fabric_operating_system
linux/linux_kernel 2.6.19 - 4.4.267
netapp/aff_500f_firmware
netapp/aff_a250_firmware
netapp/aff_a400_firmware
netapp/c250_firmware
netapp/c400_firmware
netapp/cloud_backup
netapp/fas_8300_firmware
netapp/fas_8700_firmware
... and 11 more
Published Jul 07, 2021
KEV Added Oct 06, 2025
Tracked Since Feb 18, 2026