CVE-2021-47135 (GCVE-0-2021-47135)

Vulnerability from cvelistv5 – Published: 2024-03-15 20:14 – Updated: 2026-08-05 08:46
VLAI
Title
mt76: mt7921: fix possible AOOB issue in mt7921_mcu_tx_rate_report
Summary
In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix possible AOOB issue in mt7921_mcu_tx_rate_report Fix possible array out of bound access in mt7921_mcu_tx_rate_report. Remove unnecessary varibable in mt7921_mcu_tx_rate_report
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-03-18 15:32 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1c099ab44727c8e42fe4de4d91b53cec3ef02860 , < 6919e8a24e70b6ba148fe07f44f835bcdd1a8d02 (git)
Affected: 1c099ab44727c8e42fe4de4d91b53cec3ef02860 , < d874e6c06952382897d35bf4094193cd44ae91bd (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 5.12.10 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47135",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T15:32:01.197382Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:15:22.896Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:39.911Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6919e8a24e70b6ba148fe07f44f835bcdd1a8d02"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d874e6c06952382897d35bf4094193cd44ae91bd"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7921/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6919e8a24e70b6ba148fe07f44f835bcdd1a8d02",
              "status": "affected",
              "version": "1c099ab44727c8e42fe4de4d91b53cec3ef02860",
              "versionType": "git"
            },
            {
              "lessThan": "d874e6c06952382897d35bf4094193cd44ae91bd",
              "status": "affected",
              "version": "1c099ab44727c8e42fe4de4d91b53cec3ef02860",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7921/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.10",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmt76: mt7921: fix possible AOOB issue in mt7921_mcu_tx_rate_report\n\nFix possible array out of bound access in mt7921_mcu_tx_rate_report.\nRemove unnecessary varibable in mt7921_mcu_tx_rate_report"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The OOB access is in parsing an MCU firmware GET_WTBL response inside mt7921_mcu_tx_rate_report, not in processing injected WiFi frames or remote packets; exploitation requires local reachability of the mt7921 driver path on the host.\nAC:L - When rate_idx is out of range the out-of-bounds read is deterministic with no race or other condition outside the attacker\u2019s influence once the MCU returns the malformed index.\nPR:L - An unprivileged local user can generate traffic on an already-associated mt7921 client interface, causing TX-free handling to queue the STA for mt7921_mac_sta_stats_work and the vulnerable MCU query without needing root.\nUI:N - The vulnerable path runs from kernel mac_work/watchdog after normal TX activity; no additional victim interaction is required.\nS:U - Impact stays within the host kernel\u2019s authority; this is not a VM escape, IOMMU bypass, or other cross-boundary compromise.\nC:H - rate_idx is a u8 indexing rate[8], so large values read hundreds of bytes past the event into RX/heap memory, and derived fields are stored in STA tx_rate stats that can be exposed via nl80211 station reporting.\nI:H - Kernel array-index memory unsafety here yields corrupted kernel state (stats written from OOB-derived data) and, under the higher-severity rule for memory-corruption primitives, is treated as enabling integrity compromise rather than a pure crash.\nA:H - Large out-of-bounds reads can fault on invalid kernel addresses and oops/panic the host, so availability impact is complete loss of the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:15.392Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6919e8a24e70b6ba148fe07f44f835bcdd1a8d02"
        },
        {
          "url": "https://git.kernel.org/stable/c/d874e6c06952382897d35bf4094193cd44ae91bd"
        }
      ],
      "title": "mt76: mt7921: fix possible AOOB issue in mt7921_mcu_tx_rate_report",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47135",
    "datePublished": "2024-03-15T20:14:37.589Z",
    "dateReserved": "2024-03-04T18:12:48.840Z",
    "dateUpdated": "2026-08-05T08:46:15.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47135",
      "date": "2026-09-28",
      "epss": "0.00218",
      "percentile": "0.11007"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmt76: mt7921: fix possible AOOB issue in mt7921_mcu_tx_rate_report\n\nFix possible array out of bound access in mt7921_mcu_tx_rate_report.\nRemove unnecessary varibable in mt7921_mcu_tx_rate_report"
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: mt76: mt7921: solucione un posible problema de AOOB en mt7921_mcu_tx_rate_report. Corrija un posible acceso fuera de los l\u00edmites a la matriz en mt7921_mcu_tx_rate_report. Eliminar variables innecesarias en mt7921_mcu_tx_rate_report"
        }
      ],
      "id": "CVE-2021-47135",
      "lastModified": "2024-11-21T06:35:28.083",
      "published": "2024-03-15T21:15:07.823",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/6919e8a24e70b6ba148fe07f44f835bcdd1a8d02"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/d874e6c06952382897d35bf4094193cd44ae91bd"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/6919e8a24e70b6ba148fe07f44f835bcdd1a8d02"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/d874e6c06952382897d35bf4094193cd44ae91bd"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mt7921/mcu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6919e8a24e70b6ba148fe07f44f835bcdd1a8d02",
                    "status": "affected",
                    "version": "1c099ab44727c8e42fe4de4d91b53cec3ef02860",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d874e6c06952382897d35bf4094193cd44ae91bd",
                    "status": "affected",
                    "version": "1c099ab44727c8e42fe4de4d91b53cec3ef02860",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mt7921/mcu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.12"
                  },
                  {
                    "lessThan": "5.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.12.*",
                    "status": "unaffected",
                    "version": "5.12.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.13",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C68A4290-9FFF-4037-9467-4FF878E3085F",
                    "versionEndExcluding": "5.12.10",
                    "versionStartIncluding": "5.12",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "96AC23B2-D46A-49D9-8203-8E1BEDCA8532",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "DA610E30-717C-4700-9F77-A3C9244F3BFD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "1ECD33F5-85BE-430B-8F86-8D7BD560311D",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmt76: mt7921: fix possible AOOB issue in mt7921_mcu_tx_rate_report\n\nFix possible array out of bound access in mt7921_mcu_tx_rate_report.\nRemove unnecessary varibable in mt7921_mcu_tx_rate_report"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: mt76: mt7921: solucione un posible problema de AOOB en mt7921_mcu_tx_rate_report. Corrija un posible acceso fuera de los l\u00edmites a la matriz en mt7921_mcu_tx_rate_report. Eliminar variables innecesarias en mt7921_mcu_tx_rate_report"
          }
        ],
        "id": "CVE-2021-47135",
        "lastModified": "2026-08-04T10:16:48.113",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47135",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T15:32:01.197382Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-03-15T21:15:07.823",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6919e8a24e70b6ba148fe07f44f835bcdd1a8d02"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d874e6c06952382897d35bf4094193cd44ae91bd"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6919e8a24e70b6ba148fe07f44f835bcdd1a8d02"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d874e6c06952382897d35bf4094193cd44ae91bd"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-129"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:05:06+00:00",
      "cve": "CVE-2021-47135",
      "id": "CVE-2021-47135",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mt76: mt7921: fix possible AOOB issue in mt7921_mcu_tx_rate_report",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47135.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-05T17:10:50Z",
      "cve": "CVE-2021-47135",
      "id": "CVE-2021-47135",
      "initial_release_date": "2024-03-19T03:50:22Z",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47135",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47135.json",
      "version": "18"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:24:39.911Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/6919e8a24e70b6ba148fe07f44f835bcdd1a8d02"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/d874e6c06952382897d35bf4094193cd44ae91bd"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47135",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-03-18T15:32:01.197382Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-23T19:01:18.352Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/wireless/mediatek/mt76/mt7921/mcu.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "6919e8a24e70b6ba148fe07f44f835bcdd1a8d02",
                  "status": "affected",
                  "version": "1c099ab44727c8e42fe4de4d91b53cec3ef02860",
                  "versionType": "git"
                },
                {
                  "lessThan": "d874e6c06952382897d35bf4094193cd44ae91bd",
                  "status": "affected",
                  "version": "1c099ab44727c8e42fe4de4d91b53cec3ef02860",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/wireless/mediatek/mt76/mt7921/mcu.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.12"
                },
                {
                  "lessThan": "5.12",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.12.*",
                  "status": "unaffected",
                  "version": "5.12.10",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.13",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.12.10",
                      "versionStartIncluding": "5.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.13",
                      "versionStartIncluding": "5.12",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmt76: mt7921: fix possible AOOB issue in mt7921_mcu_tx_rate_report\n\nFix possible array out of bound access in mt7921_mcu_tx_rate_report.\nRemove unnecessary varibable in mt7921_mcu_tx_rate_report"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The OOB access is in parsing an MCU firmware GET_WTBL response inside mt7921_mcu_tx_rate_report, not in processing injected WiFi frames or remote packets; exploitation requires local reachability of the mt7921 driver path on the host.\nAC:L - When rate_idx is out of range the out-of-bounds read is deterministic with no race or other condition outside the attacker\u2019s influence once the MCU returns the malformed index.\nPR:L - An unprivileged local user can generate traffic on an already-associated mt7921 client interface, causing TX-free handling to queue the STA for mt7921_mac_sta_stats_work and the vulnerable MCU query without needing root.\nUI:N - The vulnerable path runs from kernel mac_work/watchdog after normal TX activity; no additional victim interaction is required.\nS:U - Impact stays within the host kernel\u2019s authority; this is not a VM escape, IOMMU bypass, or other cross-boundary compromise.\nC:H - rate_idx is a u8 indexing rate[8], so large values read hundreds of bytes past the event into RX/heap memory, and derived fields are stored in STA tx_rate stats that can be exposed via nl80211 station reporting.\nI:H - Kernel array-index memory unsafety here yields corrupted kernel state (stats written from OOB-derived data) and, under the higher-severity rule for memory-corruption primitives, is treated as enabling integrity compromise rather than a pure crash.\nA:H - Large out-of-bounds reads can fault on invalid kernel addresses and oops/panic the host, so availability impact is complete loss of the system."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:46:15.392Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/6919e8a24e70b6ba148fe07f44f835bcdd1a8d02"
            },
            {
              "url": "https://git.kernel.org/stable/c/d874e6c06952382897d35bf4094193cd44ae91bd"
            }
          ],
          "title": "mt76: mt7921: fix possible AOOB issue in mt7921_mcu_tx_rate_report",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47135",
        "datePublished": "2024-03-15T20:14:37.589Z",
        "dateReserved": "2024-03-04T18:12:48.840Z",
        "dateUpdated": "2026-08-05T08:46:15.392Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.