CVE-2021-47194 (GCVE-0-2021-47194)

Vulnerability from cvelistv5 – Published: 2024-04-10 18:56 – Updated: 2026-08-05 08:46
VLAI
Title
cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
Summary
In the Linux kernel, the following vulnerability has been resolved: cfg80211: call cfg80211_stop_ap when switch from P2P_GO type If the userspace tools switch from NL80211_IFTYPE_P2P_GO to NL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), it does not call the cleanup cfg80211_stop_ap(), this leads to the initialization of in-use data. For example, this path re-init the sdata->assigned_chanctx_list while it is still an element of assigned_vifs list, and makes that linked list corrupt.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-21 16:05 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ac800140c20e7ae51117e71289065bedd4930fc2 , < 8f06bb8c216bcd172394f61e557727e691b4cb24 (git)
Affected: ac800140c20e7ae51117e71289065bedd4930fc2 , < 0738cdb636c21ab552eaecf905efa4a6070e3ebc (git)
Affected: ac800140c20e7ae51117e71289065bedd4930fc2 , < 4e458abbb4a523f1413bfe15c079cf4e24c15b21 (git)
Affected: ac800140c20e7ae51117e71289065bedd4930fc2 , < b8a045e2a9b234cfbc06cf36923886164358ddec (git)
Affected: ac800140c20e7ae51117e71289065bedd4930fc2 , < 52affc201fc22a1ab9a59ef0ed641a9adfcb8d13 (git)
Affected: ac800140c20e7ae51117e71289065bedd4930fc2 , < 7b97b5776daa0b39dbdadfea176f9cc0646d4a66 (git)
Affected: ac800140c20e7ae51117e71289065bedd4930fc2 , < 5a9b671c8d74a3e1b999e7a0c7f366079bcc93dd (git)
Affected: ac800140c20e7ae51117e71289065bedd4930fc2 , < 563fbefed46ae4c1f70cffb8eb54c02df480b2c2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.6
Unaffected: 0 , < 3.6 (semver)
Unaffected: 4.4.293 , ≤ 4.4.* (semver)
Unaffected: 4.9.291 , ≤ 4.9.* (semver)
Unaffected: 4.14.256 , ≤ 4.14.* (semver)
Unaffected: 4.19.218 , ≤ 4.19.* (semver)
Unaffected: 5.4.162 , ≤ 5.4.* (semver)
Unaffected: 5.10.82 , ≤ 5.10.* (semver)
Unaffected: 5.15.5 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47194",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-21T16:05:05.968362Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-21T16:05:16.617Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.292Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8f06bb8c216bcd172394f61e557727e691b4cb24"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0738cdb636c21ab552eaecf905efa4a6070e3ebc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4e458abbb4a523f1413bfe15c079cf4e24c15b21"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b8a045e2a9b234cfbc06cf36923886164358ddec"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/52affc201fc22a1ab9a59ef0ed641a9adfcb8d13"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7b97b5776daa0b39dbdadfea176f9cc0646d4a66"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5a9b671c8d74a3e1b999e7a0c7f366079bcc93dd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/563fbefed46ae4c1f70cffb8eb54c02df480b2c2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8f06bb8c216bcd172394f61e557727e691b4cb24",
              "status": "affected",
              "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
              "versionType": "git"
            },
            {
              "lessThan": "0738cdb636c21ab552eaecf905efa4a6070e3ebc",
              "status": "affected",
              "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
              "versionType": "git"
            },
            {
              "lessThan": "4e458abbb4a523f1413bfe15c079cf4e24c15b21",
              "status": "affected",
              "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
              "versionType": "git"
            },
            {
              "lessThan": "b8a045e2a9b234cfbc06cf36923886164358ddec",
              "status": "affected",
              "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
              "versionType": "git"
            },
            {
              "lessThan": "52affc201fc22a1ab9a59ef0ed641a9adfcb8d13",
              "status": "affected",
              "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
              "versionType": "git"
            },
            {
              "lessThan": "7b97b5776daa0b39dbdadfea176f9cc0646d4a66",
              "status": "affected",
              "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
              "versionType": "git"
            },
            {
              "lessThan": "5a9b671c8d74a3e1b999e7a0c7f366079bcc93dd",
              "status": "affected",
              "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
              "versionType": "git"
            },
            {
              "lessThan": "563fbefed46ae4c1f70cffb8eb54c02df480b2c2",
              "status": "affected",
              "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.6"
            },
            {
              "lessThan": "3.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.293",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.256",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.293",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.291",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.256",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.218",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.162",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.82",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.5",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncfg80211: call cfg80211_stop_ap when switch from P2P_GO type\n\nIf the userspace tools switch from NL80211_IFTYPE_P2P_GO to\nNL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), it\ndoes not call the cleanup cfg80211_stop_ap(), this leads to the\ninitialization of in-use data. For example, this path re-init the\nsdata-\u003eassigned_chanctx_list while it is still an element of\nassigned_vifs list, and makes that linked list corrupt."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered exclusively via local nl80211 Generic Netlink (NL80211_CMD_SET_INTERFACE \u2192 nl80211_set_interface \u2192 cfg80211_change_iface), not by processing over-the-air WiFi frames or remote network packets.\nAC:L - An attacker fully controls the sequence\u2014set the interface to P2P_GO, start AP (assigning the chanctx), then SET_INTERFACE to ADHOC\u2014and reliably causes INIT_LIST_HEAD on an still-linked assigned_chanctx_list with no attacker-independent race or external timing.\nPR:L - NL80211_CMD_SET_INTERFACE uses GENL_UNS_ADMIN_PERM, requiring only CAP_NET_ADMIN in the socket netns user namespace; with mac80211_hwsim (also GENL_UNS_ADMIN_PERM) or a wiphy in that netns this is reachable via unshare -Urn, so privileges score Low per CNA guidance.\nUI:N - The attacker issues the netlink commands themselves to change the interface type; no separate victim action such as mounting a filesystem or approving a prompt is required.\nS:U - Impact stays within the host kernel wireless/mac80211 authority (local list corruption / privilege-escalation class) and does not cross a VM, IOMMU, or other separate security boundary.\nC:H - INIT_LIST_HEAD on an in-use assigned_chanctx_list corrupts the chanctx assigned_vifs list, and subsequent walks dereference poisoned/reused pointers; this list-corruption class enables heap reuse and arbitrary kernel memory disclosure primitives.\nI:H - Corrupted list_head unlink/walk paths over attacker-influenced heap state yield classic arbitrary-write and control-flow hijack primitives, matching High integrity impact for kernel list corruption.\nA:H - Syzbot reproduces a general protection fault in ieee80211_chanctx_num_assigned when walking the corrupted assigned_vifs list, causing a kernel oops/panic and full denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:38.073Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8f06bb8c216bcd172394f61e557727e691b4cb24"
        },
        {
          "url": "https://git.kernel.org/stable/c/0738cdb636c21ab552eaecf905efa4a6070e3ebc"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e458abbb4a523f1413bfe15c079cf4e24c15b21"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8a045e2a9b234cfbc06cf36923886164358ddec"
        },
        {
          "url": "https://git.kernel.org/stable/c/52affc201fc22a1ab9a59ef0ed641a9adfcb8d13"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b97b5776daa0b39dbdadfea176f9cc0646d4a66"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a9b671c8d74a3e1b999e7a0c7f366079bcc93dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/563fbefed46ae4c1f70cffb8eb54c02df480b2c2"
        }
      ],
      "title": "cfg80211: call cfg80211_stop_ap when switch from P2P_GO type",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47194",
    "datePublished": "2024-04-10T18:56:31.361Z",
    "dateReserved": "2024-03-25T09:12:14.114Z",
    "dateUpdated": "2026-08-05T08:46:38.073Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47194",
      "date": "2026-09-21",
      "epss": "0.00249",
      "percentile": "0.16549"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "21B46662-20A7-48E8-8AF8-09267C266861",
                  "versionEndExcluding": "4.4.293",
                  "versionStartIncluding": "3.6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "BF25A497-0F2C-4E9F-8191-4357CE1DF4D7",
                  "versionEndExcluding": "4.9.291",
                  "versionStartIncluding": "4.5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B54B87EE-9269-470B-B916-37CFE44AA2DD",
                  "versionEndExcluding": "4.14.256",
                  "versionStartIncluding": "4.10.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "508DCDC1-955F-4ED4-ADE7-4DB7F1D89D96",
                  "versionEndExcluding": "4.19.218",
                  "versionStartIncluding": "4.15.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "8D5C9B4E-0BD6-427E-AD7E-825F5E977B56",
                  "versionEndExcluding": "5.4.162",
                  "versionStartIncluding": "4.20.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E93DC61F-3F49-4D65-B0DE-4B46B8990120",
                  "versionEndExcluding": "5.10.82",
                  "versionStartIncluding": "5.5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "4A3325B8-6321-4BCE-A6B2-BD2AFF47E127",
                  "versionEndExcluding": "5.15.5",
                  "versionStartIncluding": "5.11.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncfg80211: call cfg80211_stop_ap when switch from P2P_GO type\n\nIf the userspace tools switch from NL80211_IFTYPE_P2P_GO to\nNL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), it\ndoes not call the cleanup cfg80211_stop_ap(), this leads to the\ninitialization of in-use data. For example, this path re-init the\nsdata-\u003eassigned_chanctx_list while it is still an element of\nassigned_vifs list, and makes that linked list corrupt."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cfg80211: llame a cfg80211_stop_ap cuando cambie del tipo P2P_GO. Si las herramientas del espacio de usuario cambian de NL80211_IFTYPE_P2P_GO a NL80211_IFTYPE_ADHOC mediante send_msg(NL80211_CMD_SET_INTERFACE), no llama a la limpieza cfg80211_ stop_ap(), esto lleva a la inicializaci\u00f3n de datos en uso. Por ejemplo, esta ruta reinicia sdata-\u0026gt;assigned_chanctx_list mientras todav\u00eda es un elemento de la lista asignada_vifs y corrompe esa lista vinculada."
        }
      ],
      "id": "CVE-2021-47194",
      "lastModified": "2024-11-21T06:35:36.263",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-04-10T19:15:47.807",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/0738cdb636c21ab552eaecf905efa4a6070e3ebc"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/4e458abbb4a523f1413bfe15c079cf4e24c15b21"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/52affc201fc22a1ab9a59ef0ed641a9adfcb8d13"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/563fbefed46ae4c1f70cffb8eb54c02df480b2c2"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/5a9b671c8d74a3e1b999e7a0c7f366079bcc93dd"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/7b97b5776daa0b39dbdadfea176f9cc0646d4a66"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/8f06bb8c216bcd172394f61e557727e691b4cb24"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/b8a045e2a9b234cfbc06cf36923886164358ddec"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/0738cdb636c21ab552eaecf905efa4a6070e3ebc"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/4e458abbb4a523f1413bfe15c079cf4e24c15b21"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/52affc201fc22a1ab9a59ef0ed641a9adfcb8d13"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/563fbefed46ae4c1f70cffb8eb54c02df480b2c2"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/5a9b671c8d74a3e1b999e7a0c7f366079bcc93dd"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/7b97b5776daa0b39dbdadfea176f9cc0646d4a66"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/8f06bb8c216bcd172394f61e557727e691b4cb24"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/b8a045e2a9b234cfbc06cf36923886164358ddec"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-665"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/wireless/util.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8f06bb8c216bcd172394f61e557727e691b4cb24",
                    "status": "affected",
                    "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0738cdb636c21ab552eaecf905efa4a6070e3ebc",
                    "status": "affected",
                    "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4e458abbb4a523f1413bfe15c079cf4e24c15b21",
                    "status": "affected",
                    "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b8a045e2a9b234cfbc06cf36923886164358ddec",
                    "status": "affected",
                    "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "52affc201fc22a1ab9a59ef0ed641a9adfcb8d13",
                    "status": "affected",
                    "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7b97b5776daa0b39dbdadfea176f9cc0646d4a66",
                    "status": "affected",
                    "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5a9b671c8d74a3e1b999e7a0c7f366079bcc93dd",
                    "status": "affected",
                    "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "563fbefed46ae4c1f70cffb8eb54c02df480b2c2",
                    "status": "affected",
                    "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/wireless/util.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.6"
                  },
                  {
                    "lessThan": "3.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.4.*",
                    "status": "unaffected",
                    "version": "4.4.293",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.9.*",
                    "status": "unaffected",
                    "version": "4.9.291",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.256",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.218",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.162",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.82",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.16",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "21B46662-20A7-48E8-8AF8-09267C266861",
                    "versionEndExcluding": "4.4.293",
                    "versionStartIncluding": "3.6.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BF25A497-0F2C-4E9F-8191-4357CE1DF4D7",
                    "versionEndExcluding": "4.9.291",
                    "versionStartIncluding": "4.5.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B54B87EE-9269-470B-B916-37CFE44AA2DD",
                    "versionEndExcluding": "4.14.256",
                    "versionStartIncluding": "4.10.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "508DCDC1-955F-4ED4-ADE7-4DB7F1D89D96",
                    "versionEndExcluding": "4.19.218",
                    "versionStartIncluding": "4.15.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8D5C9B4E-0BD6-427E-AD7E-825F5E977B56",
                    "versionEndExcluding": "5.4.162",
                    "versionStartIncluding": "4.20.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E93DC61F-3F49-4D65-B0DE-4B46B8990120",
                    "versionEndExcluding": "5.10.82",
                    "versionStartIncluding": "5.5.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4A3325B8-6321-4BCE-A6B2-BD2AFF47E127",
                    "versionEndExcluding": "5.15.5",
                    "versionStartIncluding": "5.11.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncfg80211: call cfg80211_stop_ap when switch from P2P_GO type\n\nIf the userspace tools switch from NL80211_IFTYPE_P2P_GO to\nNL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), it\ndoes not call the cleanup cfg80211_stop_ap(), this leads to the\ninitialization of in-use data. For example, this path re-init the\nsdata-\u003eassigned_chanctx_list while it is still an element of\nassigned_vifs list, and makes that linked list corrupt."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cfg80211: llame a cfg80211_stop_ap cuando cambie del tipo P2P_GO. Si las herramientas del espacio de usuario cambian de NL80211_IFTYPE_P2P_GO a NL80211_IFTYPE_ADHOC mediante send_msg(NL80211_CMD_SET_INTERFACE), no llama a la limpieza cfg80211_ stop_ap(), esto lleva a la inicializaci\u00f3n de datos en uso. Por ejemplo, esta ruta reinicia sdata-\u0026gt;assigned_chanctx_list mientras todav\u00eda es un elemento de la lista asignada_vifs y corrompe esa lista vinculada."
          }
        ],
        "id": "CVE-2021-47194",
        "lastModified": "2026-08-04T10:16:51.750",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47194",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-21T16:05:05.968362Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-04-10T19:15:47.807",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0738cdb636c21ab552eaecf905efa4a6070e3ebc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4e458abbb4a523f1413bfe15c079cf4e24c15b21"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/52affc201fc22a1ab9a59ef0ed641a9adfcb8d13"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/563fbefed46ae4c1f70cffb8eb54c02df480b2c2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5a9b671c8d74a3e1b999e7a0c7f366079bcc93dd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7b97b5776daa0b39dbdadfea176f9cc0646d4a66"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8f06bb8c216bcd172394f61e557727e691b4cb24"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b8a045e2a9b234cfbc06cf36923886164358ddec"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0738cdb636c21ab552eaecf905efa4a6070e3ebc"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4e458abbb4a523f1413bfe15c079cf4e24c15b21"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/52affc201fc22a1ab9a59ef0ed641a9adfcb8d13"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/563fbefed46ae4c1f70cffb8eb54c02df480b2c2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5a9b671c8d74a3e1b999e7a0c7f366079bcc93dd"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7b97b5776daa0b39dbdadfea176f9cc0646d4a66"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8f06bb8c216bcd172394f61e557727e691b4cb24"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b8a045e2a9b234cfbc06cf36923886164358ddec"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-665"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T03:52:10+00:00",
      "cve": "CVE-2021-47194",
      "id": "CVE-2021-47194",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "108",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cfg80211: call cfg80211_stop_ap when switch from P2P_GO type",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47194.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T02:19:20Z",
      "cve": "CVE-2021-47194",
      "id": "CVE-2021-47194",
      "initial_release_date": "2024-04-15T23:20:43Z",
      "product_status:known_affected": "374",
      "product_status:known_not_affected": "91",
      "product_status:recommended": "681",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47194",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47194.json",
      "version": "59"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:32:07.292Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/8f06bb8c216bcd172394f61e557727e691b4cb24"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/0738cdb636c21ab552eaecf905efa4a6070e3ebc"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/4e458abbb4a523f1413bfe15c079cf4e24c15b21"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/b8a045e2a9b234cfbc06cf36923886164358ddec"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/52affc201fc22a1ab9a59ef0ed641a9adfcb8d13"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/7b97b5776daa0b39dbdadfea176f9cc0646d4a66"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/5a9b671c8d74a3e1b999e7a0c7f366079bcc93dd"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/563fbefed46ae4c1f70cffb8eb54c02df480b2c2"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47194",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-06-21T16:05:05.968362Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-06-21T16:05:12.884Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/wireless/util.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "8f06bb8c216bcd172394f61e557727e691b4cb24",
                  "status": "affected",
                  "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
                  "versionType": "git"
                },
                {
                  "lessThan": "0738cdb636c21ab552eaecf905efa4a6070e3ebc",
                  "status": "affected",
                  "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
                  "versionType": "git"
                },
                {
                  "lessThan": "4e458abbb4a523f1413bfe15c079cf4e24c15b21",
                  "status": "affected",
                  "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
                  "versionType": "git"
                },
                {
                  "lessThan": "b8a045e2a9b234cfbc06cf36923886164358ddec",
                  "status": "affected",
                  "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
                  "versionType": "git"
                },
                {
                  "lessThan": "52affc201fc22a1ab9a59ef0ed641a9adfcb8d13",
                  "status": "affected",
                  "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
                  "versionType": "git"
                },
                {
                  "lessThan": "7b97b5776daa0b39dbdadfea176f9cc0646d4a66",
                  "status": "affected",
                  "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
                  "versionType": "git"
                },
                {
                  "lessThan": "5a9b671c8d74a3e1b999e7a0c7f366079bcc93dd",
                  "status": "affected",
                  "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
                  "versionType": "git"
                },
                {
                  "lessThan": "563fbefed46ae4c1f70cffb8eb54c02df480b2c2",
                  "status": "affected",
                  "version": "ac800140c20e7ae51117e71289065bedd4930fc2",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/wireless/util.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "3.6"
                },
                {
                  "lessThan": "3.6",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.4.*",
                  "status": "unaffected",
                  "version": "4.4.293",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.9.*",
                  "status": "unaffected",
                  "version": "4.9.291",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.14.*",
                  "status": "unaffected",
                  "version": "4.14.256",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.218",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.162",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.82",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.5",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.16",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.4.293",
                      "versionStartIncluding": "3.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.9.291",
                      "versionStartIncluding": "3.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.14.256",
                      "versionStartIncluding": "3.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.218",
                      "versionStartIncluding": "3.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.162",
                      "versionStartIncluding": "3.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.82",
                      "versionStartIncluding": "3.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.5",
                      "versionStartIncluding": "3.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.16",
                      "versionStartIncluding": "3.6",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncfg80211: call cfg80211_stop_ap when switch from P2P_GO type\n\nIf the userspace tools switch from NL80211_IFTYPE_P2P_GO to\nNL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), it\ndoes not call the cleanup cfg80211_stop_ap(), this leads to the\ninitialization of in-use data. For example, this path re-init the\nsdata-\u003eassigned_chanctx_list while it is still an element of\nassigned_vifs list, and makes that linked list corrupt."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerability is triggered exclusively via local nl80211 Generic Netlink (NL80211_CMD_SET_INTERFACE \u2192 nl80211_set_interface \u2192 cfg80211_change_iface), not by processing over-the-air WiFi frames or remote network packets.\nAC:L - An attacker fully controls the sequence\u2014set the interface to P2P_GO, start AP (assigning the chanctx), then SET_INTERFACE to ADHOC\u2014and reliably causes INIT_LIST_HEAD on an still-linked assigned_chanctx_list with no attacker-independent race or external timing.\nPR:L - NL80211_CMD_SET_INTERFACE uses GENL_UNS_ADMIN_PERM, requiring only CAP_NET_ADMIN in the socket netns user namespace; with mac80211_hwsim (also GENL_UNS_ADMIN_PERM) or a wiphy in that netns this is reachable via unshare -Urn, so privileges score Low per CNA guidance.\nUI:N - The attacker issues the netlink commands themselves to change the interface type; no separate victim action such as mounting a filesystem or approving a prompt is required.\nS:U - Impact stays within the host kernel wireless/mac80211 authority (local list corruption / privilege-escalation class) and does not cross a VM, IOMMU, or other separate security boundary.\nC:H - INIT_LIST_HEAD on an in-use assigned_chanctx_list corrupts the chanctx assigned_vifs list, and subsequent walks dereference poisoned/reused pointers; this list-corruption class enables heap reuse and arbitrary kernel memory disclosure primitives.\nI:H - Corrupted list_head unlink/walk paths over attacker-influenced heap state yield classic arbitrary-write and control-flow hijack primitives, matching High integrity impact for kernel list corruption.\nA:H - Syzbot reproduces a general protection fault in ieee80211_chanctx_num_assigned when walking the corrupted assigned_vifs list, causing a kernel oops/panic and full denial of service."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:46:38.073Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/8f06bb8c216bcd172394f61e557727e691b4cb24"
            },
            {
              "url": "https://git.kernel.org/stable/c/0738cdb636c21ab552eaecf905efa4a6070e3ebc"
            },
            {
              "url": "https://git.kernel.org/stable/c/4e458abbb4a523f1413bfe15c079cf4e24c15b21"
            },
            {
              "url": "https://git.kernel.org/stable/c/b8a045e2a9b234cfbc06cf36923886164358ddec"
            },
            {
              "url": "https://git.kernel.org/stable/c/52affc201fc22a1ab9a59ef0ed641a9adfcb8d13"
            },
            {
              "url": "https://git.kernel.org/stable/c/7b97b5776daa0b39dbdadfea176f9cc0646d4a66"
            },
            {
              "url": "https://git.kernel.org/stable/c/5a9b671c8d74a3e1b999e7a0c7f366079bcc93dd"
            },
            {
              "url": "https://git.kernel.org/stable/c/563fbefed46ae4c1f70cffb8eb54c02df480b2c2"
            }
          ],
          "title": "cfg80211: call cfg80211_stop_ap when switch from P2P_GO type",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47194",
        "datePublished": "2024-04-10T18:56:31.361Z",
        "dateReserved": "2024-03-25T09:12:14.114Z",
        "dateUpdated": "2026-08-05T08:46:38.073Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.