CVE-2025-22021 is a medium severity vulnerability in the Linux kernel's netfilter socket handling for IPv6 SNAT packets. The issue arises because the IPv6 path lacks a connection tracking lookup that the IPv4 path performs, causing the xt_socket module to fail to match sockets for SNATed IPv6 packets. This affects Kubernetes clusters using IPv6 SNAT for pod-to-world communication, impacting tools like Cilium that rely on transparent socket matching for enforcing Layer 7 policies. The vulnerability can cause denial of service (availability impact) due to improper socket matching.