CVE-2021-46998 (GCVE-0-2021-46998)

Vulnerability from cvelistv5 – Published: 2024-02-28 08:13 – Updated: 2026-08-05 08:45
VLAI
Title
ethernet:enic: Fix a use after free bug in enic_hard_start_xmit
Summary
In the Linux kernel, the following vulnerability has been resolved: ethernet:enic: Fix a use after free bug in enic_hard_start_xmit In enic_hard_start_xmit, it calls enic_queue_wq_skb(). Inside enic_queue_wq_skb, if some error happens, the skb will be freed by dev_kfree_skb(skb). But the freed skb is still used in skb_tx_timestamp(skb). My patch makes enic_queue_wq_skb() return error and goto spin_unlock() incase of error. The solution is provided by Govind. See https://lkml.org/lkml/2021/4/30/961.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:00 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3 , < 25a87b1f566b5eb2af2857a928f0e2310d900976 (git)
Affected: fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3 , < f7f6f07774091a6ddd98500b85386c3c6afb30d3 (git)
Affected: fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3 , < 7afdd6aba95c8a526038e7abe283eeac3e4320f1 (git)
Affected: fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3 , < 6892396ebf04ea2c021d80e10f4075e014cd7cc3 (git)
Affected: fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3 , < d90529392aaf498dafa95d212295d64b2cea4e24 (git)
Affected: fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3 , < 643001b47adc844ae33510c4bb93c236667008a3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 4.19.191 , ≤ 4.19.* (semver)
Unaffected: 5.4.120 , ≤ 5.4.* (semver)
Unaffected: 5.10.38 , ≤ 5.10.* (semver)
Unaffected: 5.11.22 , ≤ 5.11.* (semver)
Unaffected: 5.12.5 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:38.462Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/25a87b1f566b5eb2af2857a928f0e2310d900976"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f7f6f07774091a6ddd98500b85386c3c6afb30d3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7afdd6aba95c8a526038e7abe283eeac3e4320f1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6892396ebf04ea2c021d80e10f4075e014cd7cc3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d90529392aaf498dafa95d212295d64b2cea4e24"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/643001b47adc844ae33510c4bb93c236667008a3"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-46998",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:00:51.946004Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:36.196Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/cisco/enic/enic_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "25a87b1f566b5eb2af2857a928f0e2310d900976",
              "status": "affected",
              "version": "fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3",
              "versionType": "git"
            },
            {
              "lessThan": "f7f6f07774091a6ddd98500b85386c3c6afb30d3",
              "status": "affected",
              "version": "fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3",
              "versionType": "git"
            },
            {
              "lessThan": "7afdd6aba95c8a526038e7abe283eeac3e4320f1",
              "status": "affected",
              "version": "fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3",
              "versionType": "git"
            },
            {
              "lessThan": "6892396ebf04ea2c021d80e10f4075e014cd7cc3",
              "status": "affected",
              "version": "fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3",
              "versionType": "git"
            },
            {
              "lessThan": "d90529392aaf498dafa95d212295d64b2cea4e24",
              "status": "affected",
              "version": "fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3",
              "versionType": "git"
            },
            {
              "lessThan": "643001b47adc844ae33510c4bb93c236667008a3",
              "status": "affected",
              "version": "fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/cisco/enic/enic_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.11.*",
              "status": "unaffected",
              "version": "5.11.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.191",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.120",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.38",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.22",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.5",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethernet:enic: Fix a use after free bug in enic_hard_start_xmit\n\nIn enic_hard_start_xmit, it calls enic_queue_wq_skb(). Inside\nenic_queue_wq_skb, if some error happens, the skb will be freed\nby dev_kfree_skb(skb). But the freed skb is still used in\nskb_tx_timestamp(skb).\n\nMy patch makes enic_queue_wq_skb() return error and goto spin_unlock()\nincase of error. The solution is provided by Govind.\nSee https://lkml.org/lkml/2021/4/30/961."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is in enic ndo_start_xmit (enic_hard_start_xmit \u2192 enic_queue_wq_skb \u2192 skb_tx_timestamp), reached when a local process transmits via ordinary socket send over an enic netdev; remote peers do not enter this TX-prepare path.\nAC:L - Once DMA mapping fails, the free-then-skb_tx_timestamp UAF is deterministic with no race; a local attacker can induce mapping failure by exhausting swiotlb/IOMMU resources, which is within attacker influence.\nPR:L - Any unprivileged local user can send packets out an up enic interface through the generic networking stack; no CAP_NET_ADMIN or other capability is required on the transmit path.\nUI:N - The attacker triggers the TX path and resource exhaustion themselves via their own send syscalls; no victim action is required.\nS:U - This is a standard in-kernel skb heap UAF enabling local privilege escalation within the same kernel security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - Use-after-free of the skb (skb_shinfo/tx_flags access, and skb_tstamp_tx when SKBTX_SW_TSTAMP is set) allows heap spraying and reuse of the freed object, enabling arbitrary kernel memory disclosure primitives.\nI:H - The same skb UAF enables heap corruption and write/control-flow hijack primitives after reclaim, per UAF exploitation guidance.\nA:H - Accessing the freed skb in skb_tx_timestamp reliably causes kernel oops/panic even without a full exploit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:45:27.902Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/25a87b1f566b5eb2af2857a928f0e2310d900976"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7f6f07774091a6ddd98500b85386c3c6afb30d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/7afdd6aba95c8a526038e7abe283eeac3e4320f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/6892396ebf04ea2c021d80e10f4075e014cd7cc3"
        },
        {
          "url": "https://git.kernel.org/stable/c/d90529392aaf498dafa95d212295d64b2cea4e24"
        },
        {
          "url": "https://git.kernel.org/stable/c/643001b47adc844ae33510c4bb93c236667008a3"
        }
      ],
      "title": "ethernet:enic: Fix a use after free bug in enic_hard_start_xmit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-46998",
    "datePublished": "2024-02-28T08:13:21.651Z",
    "dateReserved": "2024-02-27T18:42:55.950Z",
    "dateUpdated": "2026-08-05T08:45:27.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-46998",
      "date": "2026-09-28",
      "epss": "0.00244",
      "percentile": "0.14051"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "F677F1C8-2451-43EC-9555-E283697C189E",
                  "versionEndExcluding": "4.19.191",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "2BDC71CF-4451-4D53-93E9-61DE7C4E25B0",
                  "versionEndExcluding": "5.4.120",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "2BB4E5E8-4AAD-475A-A1B9-F287254C7D72",
                  "versionEndExcluding": "5.10.38",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "83B53E9A-F426-4C03-9A5F-A931FF79827E",
                  "versionEndExcluding": "5.11.22",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "0274929A-B36C-4F4C-AB22-30A0DD6B995B",
                  "versionEndExcluding": "5.12.5",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethernet:enic: Fix a use after free bug in enic_hard_start_xmit\n\nIn enic_hard_start_xmit, it calls enic_queue_wq_skb(). Inside\nenic_queue_wq_skb, if some error happens, the skb will be freed\nby dev_kfree_skb(skb). But the freed skb is still used in\nskb_tx_timestamp(skb).\n\nMy patch makes enic_queue_wq_skb() return error and goto spin_unlock()\nincase of error. The solution is provided by Govind.\nSee https://lkml.org/lkml/2021/4/30/961."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ethernet:enic: corrige un error de use after free en enic_hard_start_xmit. En enic_hard_start_xmit, llama a enic_queue_wq_skb(). Dentro de enic_queue_wq_skb, si ocurre alg\u00fan error, dev_kfree_skb(skb) liberar\u00e1 el skb. Pero el skb liberado todav\u00eda se usa en skb_tx_timestamp(skb). Mi parche hace que enic_queue_wq_skb() devuelva un error y vaya a spin_unlock() en caso de error. La soluci\u00f3n la proporciona Govind. Consulte https://lkml.org/lkml/2021/4/30/961."
        }
      ],
      "id": "CVE-2021-46998",
      "lastModified": "2024-12-06T14:56:48.477",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-02-28T09:15:38.090",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/25a87b1f566b5eb2af2857a928f0e2310d900976"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/643001b47adc844ae33510c4bb93c236667008a3"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/6892396ebf04ea2c021d80e10f4075e014cd7cc3"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/7afdd6aba95c8a526038e7abe283eeac3e4320f1"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/d90529392aaf498dafa95d212295d64b2cea4e24"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/f7f6f07774091a6ddd98500b85386c3c6afb30d3"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/25a87b1f566b5eb2af2857a928f0e2310d900976"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/643001b47adc844ae33510c4bb93c236667008a3"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/6892396ebf04ea2c021d80e10f4075e014cd7cc3"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/7afdd6aba95c8a526038e7abe283eeac3e4320f1"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/d90529392aaf498dafa95d212295d64b2cea4e24"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/f7f6f07774091a6ddd98500b85386c3c6afb30d3"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-416"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/cisco/enic/enic_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "25a87b1f566b5eb2af2857a928f0e2310d900976",
                    "status": "affected",
                    "version": "fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f7f6f07774091a6ddd98500b85386c3c6afb30d3",
                    "status": "affected",
                    "version": "fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7afdd6aba95c8a526038e7abe283eeac3e4320f1",
                    "status": "affected",
                    "version": "fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6892396ebf04ea2c021d80e10f4075e014cd7cc3",
                    "status": "affected",
                    "version": "fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d90529392aaf498dafa95d212295d64b2cea4e24",
                    "status": "affected",
                    "version": "fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "643001b47adc844ae33510c4bb93c236667008a3",
                    "status": "affected",
                    "version": "fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/cisco/enic/enic_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.16"
                  },
                  {
                    "lessThan": "4.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.191",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.120",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.38",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.11.*",
                    "status": "unaffected",
                    "version": "5.11.22",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.12.*",
                    "status": "unaffected",
                    "version": "5.12.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.13",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F677F1C8-2451-43EC-9555-E283697C189E",
                    "versionEndExcluding": "4.19.191",
                    "versionStartIncluding": "4.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2BDC71CF-4451-4D53-93E9-61DE7C4E25B0",
                    "versionEndExcluding": "5.4.120",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2BB4E5E8-4AAD-475A-A1B9-F287254C7D72",
                    "versionEndExcluding": "5.10.38",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "83B53E9A-F426-4C03-9A5F-A931FF79827E",
                    "versionEndExcluding": "5.11.22",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0274929A-B36C-4F4C-AB22-30A0DD6B995B",
                    "versionEndExcluding": "5.12.5",
                    "versionStartIncluding": "5.12",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethernet:enic: Fix a use after free bug in enic_hard_start_xmit\n\nIn enic_hard_start_xmit, it calls enic_queue_wq_skb(). Inside\nenic_queue_wq_skb, if some error happens, the skb will be freed\nby dev_kfree_skb(skb). But the freed skb is still used in\nskb_tx_timestamp(skb).\n\nMy patch makes enic_queue_wq_skb() return error and goto spin_unlock()\nincase of error. The solution is provided by Govind.\nSee https://lkml.org/lkml/2021/4/30/961."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ethernet:enic: corrige un error de use after free en enic_hard_start_xmit. En enic_hard_start_xmit, llama a enic_queue_wq_skb(). Dentro de enic_queue_wq_skb, si ocurre alg\u00fan error, dev_kfree_skb(skb) liberar\u00e1 el skb. Pero el skb liberado todav\u00eda se usa en skb_tx_timestamp(skb). Mi parche hace que enic_queue_wq_skb() devuelva un error y vaya a spin_unlock() en caso de error. La soluci\u00f3n la proporciona Govind. Consulte https://lkml.org/lkml/2021/4/30/961."
          }
        ],
        "id": "CVE-2021-46998",
        "lastModified": "2026-08-04T10:16:40.587",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-46998",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:00:51.946004Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-02-28T09:15:38.090",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/25a87b1f566b5eb2af2857a928f0e2310d900976"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/643001b47adc844ae33510c4bb93c236667008a3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6892396ebf04ea2c021d80e10f4075e014cd7cc3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7afdd6aba95c8a526038e7abe283eeac3e4320f1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d90529392aaf498dafa95d212295d64b2cea4e24"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f7f6f07774091a6ddd98500b85386c3c6afb30d3"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/25a87b1f566b5eb2af2857a928f0e2310d900976"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/643001b47adc844ae33510c4bb93c236667008a3"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6892396ebf04ea2c021d80e10f4075e014cd7cc3"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7afdd6aba95c8a526038e7abe283eeac3e4320f1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d90529392aaf498dafa95d212295d64b2cea4e24"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f7f6f07774091a6ddd98500b85386c3c6afb30d3"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T20:06:18+00:00",
      "cve": "CVE-2021-46998",
      "id": "CVE-2021-46998",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ethernet:enic: Fix a use after free bug in enic_hard_start_xmit",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-46998.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-09T00:38:55Z",
      "cve": "CVE-2021-46998",
      "id": "CVE-2021-46998",
      "initial_release_date": "2024-03-01T04:07:58Z",
      "product_status:known_affected": "388",
      "product_status:known_not_affected": "270",
      "product_status:recommended": "207",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-46998",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-46998.json",
      "version": "53"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:24:38.462Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/25a87b1f566b5eb2af2857a928f0e2310d900976"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/f7f6f07774091a6ddd98500b85386c3c6afb30d3"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/7afdd6aba95c8a526038e7abe283eeac3e4320f1"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/6892396ebf04ea2c021d80e10f4075e014cd7cc3"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/d90529392aaf498dafa95d212295d64b2cea4e24"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/643001b47adc844ae33510c4bb93c236667008a3"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-46998",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T16:00:51.946004Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:17.576Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/cisco/enic/enic_main.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "25a87b1f566b5eb2af2857a928f0e2310d900976",
                  "status": "affected",
                  "version": "fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3",
                  "versionType": "git"
                },
                {
                  "lessThan": "f7f6f07774091a6ddd98500b85386c3c6afb30d3",
                  "status": "affected",
                  "version": "fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3",
                  "versionType": "git"
                },
                {
                  "lessThan": "7afdd6aba95c8a526038e7abe283eeac3e4320f1",
                  "status": "affected",
                  "version": "fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3",
                  "versionType": "git"
                },
                {
                  "lessThan": "6892396ebf04ea2c021d80e10f4075e014cd7cc3",
                  "status": "affected",
                  "version": "fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3",
                  "versionType": "git"
                },
                {
                  "lessThan": "d90529392aaf498dafa95d212295d64b2cea4e24",
                  "status": "affected",
                  "version": "fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3",
                  "versionType": "git"
                },
                {
                  "lessThan": "643001b47adc844ae33510c4bb93c236667008a3",
                  "status": "affected",
                  "version": "fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/cisco/enic/enic_main.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.16"
                },
                {
                  "lessThan": "4.16",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.191",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.120",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.38",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.11.*",
                  "status": "unaffected",
                  "version": "5.11.22",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.12.*",
                  "status": "unaffected",
                  "version": "5.12.5",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.13",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.191",
                      "versionStartIncluding": "4.16",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.120",
                      "versionStartIncluding": "4.16",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.38",
                      "versionStartIncluding": "4.16",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.11.22",
                      "versionStartIncluding": "4.16",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.12.5",
                      "versionStartIncluding": "4.16",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.13",
                      "versionStartIncluding": "4.16",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethernet:enic: Fix a use after free bug in enic_hard_start_xmit\n\nIn enic_hard_start_xmit, it calls enic_queue_wq_skb(). Inside\nenic_queue_wq_skb, if some error happens, the skb will be freed\nby dev_kfree_skb(skb). But the freed skb is still used in\nskb_tx_timestamp(skb).\n\nMy patch makes enic_queue_wq_skb() return error and goto spin_unlock()\nincase of error. The solution is provided by Govind.\nSee https://lkml.org/lkml/2021/4/30/961."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The UAF is in enic ndo_start_xmit (enic_hard_start_xmit \u2192 enic_queue_wq_skb \u2192 skb_tx_timestamp), reached when a local process transmits via ordinary socket send over an enic netdev; remote peers do not enter this TX-prepare path.\nAC:L - Once DMA mapping fails, the free-then-skb_tx_timestamp UAF is deterministic with no race; a local attacker can induce mapping failure by exhausting swiotlb/IOMMU resources, which is within attacker influence.\nPR:L - Any unprivileged local user can send packets out an up enic interface through the generic networking stack; no CAP_NET_ADMIN or other capability is required on the transmit path.\nUI:N - The attacker triggers the TX path and resource exhaustion themselves via their own send syscalls; no victim action is required.\nS:U - This is a standard in-kernel skb heap UAF enabling local privilege escalation within the same kernel security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - Use-after-free of the skb (skb_shinfo/tx_flags access, and skb_tstamp_tx when SKBTX_SW_TSTAMP is set) allows heap spraying and reuse of the freed object, enabling arbitrary kernel memory disclosure primitives.\nI:H - The same skb UAF enables heap corruption and write/control-flow hijack primitives after reclaim, per UAF exploitation guidance.\nA:H - Accessing the freed skb in skb_tx_timestamp reliably causes kernel oops/panic even without a full exploit."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:45:27.902Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/25a87b1f566b5eb2af2857a928f0e2310d900976"
            },
            {
              "url": "https://git.kernel.org/stable/c/f7f6f07774091a6ddd98500b85386c3c6afb30d3"
            },
            {
              "url": "https://git.kernel.org/stable/c/7afdd6aba95c8a526038e7abe283eeac3e4320f1"
            },
            {
              "url": "https://git.kernel.org/stable/c/6892396ebf04ea2c021d80e10f4075e014cd7cc3"
            },
            {
              "url": "https://git.kernel.org/stable/c/d90529392aaf498dafa95d212295d64b2cea4e24"
            },
            {
              "url": "https://git.kernel.org/stable/c/643001b47adc844ae33510c4bb93c236667008a3"
            }
          ],
          "title": "ethernet:enic: Fix a use after free bug in enic_hard_start_xmit",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-46998",
        "datePublished": "2024-02-28T08:13:21.651Z",
        "dateReserved": "2024-02-27T18:42:55.950Z",
        "dateUpdated": "2026-08-05T08:45:27.902Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.