CVE-2021-47146— mld: fix panic in mld_newpack()
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于可能存在内核恐慌。
Possible ATT&CK Techniques 1 AI
T1498 · Network Denial of ServiceAffected Version Matrix 18
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 72e09ad107e78d69ff4d3b97a69f0aad2b77280f< 0e35b7457b7b6e73ffeaaca1a577fdf1af0feca1 |
affected |
72e09ad107e78d69ff4d3b97a69f0aad2b77280f< 17728616a4c85baf0edc975c60ba4e4157684d9a |
affected | ||
72e09ad107e78d69ff4d3b97a69f0aad2b77280f< 221142038f36d9f28b64e83e954774da4d4ccd17 |
affected | ||
72e09ad107e78d69ff4d3b97a69f0aad2b77280f< 4b77ad9097067b31237eeeee0bf70f80849680a0 |
affected | ||
72e09ad107e78d69ff4d3b97a69f0aad2b77280f< 37d697759958d111439080bab7e14d2b0e7b39f5 |
affected | ||
72e09ad107e78d69ff4d3b97a69f0aad2b77280f< beb39adb150f8f3b516ddf7c39835a9788704d23 |
affected | ||
72e09ad107e78d69ff4d3b97a69f0aad2b77280f< a76fb9ba545289379acf409653ad5f74417be59c |
affected | ||
72e09ad107e78d69ff4d3b97a69f0aad2b77280f< 020ef930b826d21c5446fdc9db80fd72a791bc21 |
affected | ||
| … +10 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-47146
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
mld: fix panic in mld_newpack()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
mld: fix panic in mld_newpack()
mld_newpack() doesn't allow to allocate high order page,
only order-0 allocation is allowed.
If headroom size is too large, a kernel panic could occur in skb_put().
Test commands:
ip netns del A
ip netns del B
ip netns add A
ip netns add B
ip link add veth0 type veth peer name veth1
ip link set veth0 netns A
ip link set veth1 netns B
ip netns exec A ip link set lo up
ip netns exec A ip link set veth0 up
ip netns exec A ip -6 a a 2001:db8:0::1/64 dev veth0
ip netns exec B ip link set lo up
ip netns exec B ip link set veth1 up
ip netns exec B ip -6 a a 2001:db8:0::2/64 dev veth1
for i in {1..99}
do
let A=$i-1
ip netns exec A ip link add ip6gre$i type ip6gre \
local 2001:db8:$A::1 remote 2001:db8:$A::2 encaplimit 100
ip netns exec A ip -6 a a 2001:db8:$i::1/64 dev ip6gre$i
ip netns exec A ip link set ip6gre$i up
ip netns exec B ip link add ip6gre$i type ip6gre \
local 2001:db8:$A::2 remote 2001:db8:$A::1 encaplimit 100
ip netns exec B ip -6 a a 2001:db8:$i::2/64 dev ip6gre$i
ip netns exec B ip link set ip6gre$i up
done
Splat looks like:
kernel BUG at net/core/skbuff.c:110!
invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.12.0+ #891
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:skb_panic+0x15d/0x15f
Code: 92 fe 4c 8b 4c 24 10 53 8b 4d 70 45 89 e0 48 c7 c7 00 ae 79 83
41 57 41 56 41 55 48 8b 54 24 a6 26 f9 ff <0f> 0b 48 8b 6c 24 20 89
34 24 e8 4a 4e 92 fe 8b 34 24 48 c7 c1 20
RSP: 0018:ffff88810091f820 EFLAGS: 00010282
RAX: 0000000000000089 RBX: ffff8881086e9000 RCX: 0000000000000000
RDX: 0000000000000089 RSI: 0000000000000008 RDI: ffffed1020123efb
RBP: ffff888005f6eac0 R08: ffffed1022fc0031 R09: ffffed1022fc0031
R10: ffff888117e00187 R11: ffffed1022fc0030 R12: 0000000000000028
R13: ffff888008284eb0 R14: 0000000000000ed8 R15: 0000000000000ec0
FS: 0000000000000000(0000) GS:ffff888117c00000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8b801c5640 CR3: 0000000033c2c006 CR4: 00000000003706f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
? ip6_mc_hdr.isra.26.constprop.46+0x12a/0x600
? ip6_mc_hdr.isra.26.constprop.46+0x12a/0x600
skb_put.cold.104+0x22/0x22
ip6_mc_hdr.isra.26.constprop.46+0x12a/0x600
? rcu_read_lock_sched_held+0x91/0xc0
mld_newpack+0x398/0x8f0
? ip6_mc_hdr.isra.26.constprop.46+0x600/0x600
? lock_contended+0xc40/0xc40
add_grhead.isra.33+0x280/0x380
add_grec+0x5ca/0xff0
? mld_sendpack+0xf40/0xf40
? lock_downgrade+0x690/0x690
mld_send_initial_cr.part.34+0xb9/0x180
ipv6_mc_dad_complete+0x15d/0x1b0
addrconf_dad_completed+0x8d2/0xbb0
? lock_downgrade+0x690/0x690
? addrconf_rs_timer+0x660/0x660
? addrconf_dad_work+0x73c/0x10e0
addrconf_dad_work+0x73c/0x10e0
Allowing high order page allocation could fix this problem.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于可能存在内核恐慌。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-47146
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-47146
请登录查看更多情报信息。
Other References for CVE-2021-47146 (8)
Same Patch Batch · Linux · 2024-03-25 · 40 CVEs total
| CVE-2021-47137 | 9.8 CRITICAL | net: lantiq: fix memory corruption in RX ring |
| CVE-2021-47162 | 9.8 CRITICAL | tipc: skb_linearize the head skb when reassembling msgs |
| CVE-2021-47168 | 9.8 CRITICAL | NFS: fix an incorrect limit in filelayout_decode_layout() |
| CVE-2021-47136 | 8.6 HIGH | net: zero-initialize tc skb extension on allocation |
| CVE-2021-47160 | 8.1 HIGH | net: dsa: mt7530: fix VLAN traffic leaks |
| CVE-2021-47142 | 7.8 HIGH | drm/amdgpu: Fix a use-after-free |
| CVE-2021-47175 | 7.8 HIGH | net/sched: fq_pie: fix OOB access in the traffic path |
| CVE-2021-47148 | 7.8 HIGH | octeontx2-pf: fix a buffer overflow in otx2_set_rxfh_context() |
| CVE-2021-47163 | 7.8 HIGH | tipc: wait and exit until all work queues are done |
| CVE-2021-47152 | 7.8 HIGH | mptcp: fix data stream corruption |
| CVE-2021-47153 | 7.8 HIGH | i2c: i801: Don't generate an interrupt on bus reset |
| CVE-2021-47158 | 7.8 HIGH | net: dsa: sja1105: add error handling in sja1105_setup() |
| CVE-2021-47159 | 7.8 HIGH | net: dsa: fix a crash if ->get_sset_count() fails |
| CVE-2021-47178 | 7.5 HIGH | scsi: target: core: Avoid smp_processor_id() in preemptible code |
| CVE-2021-47179 | 7.5 HIGH | NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() |
| CVE-2021-47180 | NFC: nci: fix memory leak in nci_allocate_device | |
| CVE-2021-47169 | serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait' | |
| CVE-2021-47170 | USB: usbfs: Don't WARN about excessively large memory allocations | |
| CVE-2021-47167 | NFS: Fix an Oopsable condition in __nfs_pageio_add_request() | |
| CVE-2021-47171 | net: usb: fix memory leak in smsc75xx_bind |
Showing top 20 of 40 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
Same vendor: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
V. Comments for CVE-2021-47146
No comments yet