CVE-2021-47306

HIGH

Linux Kernel < 5.4.135 - Use-After-Free in FDDI fza_probe

Title source: llm

Description

In the Linux kernel, the following vulnerability has been resolved: net: fddi: fix UAF in fza_probe fp is netdev private data and it cannot be used after free_netdev() call. Using fp after free_netdev() can cause UAF bug. Fix it by moving free_netdev() after error message. TURBOchannel adapter")

References (4)

Core 4

Core References

Patch

https://git.kernel.org/stable/c/04b06716838bfc26742dbed3ae1d3697fe5317ee

Patch

https://git.kernel.org/stable/c/f33605908a9b6063525e9f68e62d739948c5fccf

Patch

https://git.kernel.org/stable/c/bdfbb51f7a437ae8ea91317a5c133ec13adf3c47

Patch

https://git.kernel.org/stable/c/deb7178eb940e2c5caca1b1db084a69b2e59b4c9

Scores

CVSS v3 7.8

EPSS 0.0023

EPSS Percentile 13.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-416

Status published

Products (12)

Linux/Linux < 4.20

Linux/Linux 4.20

Linux/Linux 5.10.53 - 5.10.*

Linux/Linux 5.13.5 - 5.13.*

Linux/Linux 5.14

Linux/Linux 5.4.135 - 5.4.*

Linux/Linux 61414f5ec9834df8aa4f55c90de16b71a3d6ca8d - 04b06716838bfc26742dbed3ae1d3697fe5317ee

Linux/Linux 61414f5ec9834df8aa4f55c90de16b71a3d6ca8d - bdfbb51f7a437ae8ea91317a5c133ec13adf3c47

Linux/Linux 61414f5ec9834df8aa4f55c90de16b71a3d6ca8d - deb7178eb940e2c5caca1b1db084a69b2e59b4c9

Linux/Linux 61414f5ec9834df8aa4f55c90de16b71a3d6ca8d - f33605908a9b6063525e9f68e62d739948c5fccf

... and 2 more

Published May 21, 2024

Tracked Since Feb 18, 2026