CVE-2021-47222 (GCVE-0-2021-47222)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:19 – Updated: 2026-08-05 08:46
VLAI
Title
net: bridge: fix vlan tunnel dst refcnt when egressing
Summary
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix vlan tunnel dst refcnt when egressing The egress tunnel code uses dst_clone() and directly sets the result which is wrong because the entry might have 0 refcnt or be already deleted, causing number of problems. It also triggers the WARN_ON() in dst_hold()[1] when a refcnt couldn't be taken. Fix it by using dst_hold_safe() and checking if a reference was actually taken before setting the dst. [1] dmesg WARN_ON log and following refcnt errors WARNING: CPU: 5 PID: 38 at include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge] Modules linked in: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net CPU: 5 PID: 38 Comm: ksoftirqd/5 Kdump: loaded Tainted: G W 5.13.0-rc3+ #360 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 RIP: 0010:br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge] Code: e8 85 bc 01 e1 45 84 f6 74 90 45 31 f6 85 db 48 c7 c7 a0 02 19 a0 41 0f 94 c6 31 c9 31 d2 44 89 f6 e8 64 bc 01 e1 85 db 75 02 <0f> 0b 31 c9 31 d2 44 89 f6 48 c7 c7 70 02 19 a0 e8 4b bc 01 e1 49 RSP: 0018:ffff8881003d39e8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffa01902a0 RBP: ffff8881040c6700 R08: 0000000000000000 R09: 0000000000000001 R10: 2ce93d0054fe0d00 R11: 54fe0d00000e0000 R12: ffff888109515000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000401 FS: 0000000000000000(0000) GS:ffff88822bf40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f42ba70f030 CR3: 0000000109926000 CR4: 00000000000006e0 Call Trace: br_handle_vlan+0xbc/0xca [bridge] __br_forward+0x23/0x164 [bridge] deliver_clone+0x41/0x48 [bridge] br_handle_frame_finish+0x36f/0x3aa [bridge] ? skb_dst+0x2e/0x38 [bridge] ? br_handle_ingress_vlan_tunnel+0x3e/0x1c8 [bridge] ? br_handle_frame_finish+0x3aa/0x3aa [bridge] br_handle_frame+0x2c3/0x377 [bridge] ? __skb_pull+0x33/0x51 ? vlan_do_receive+0x4f/0x36a ? br_handle_frame_finish+0x3aa/0x3aa [bridge] __netif_receive_skb_core+0x539/0x7c6 ? __list_del_entry_valid+0x16e/0x1c2 __netif_receive_skb_list_core+0x6d/0xd6 netif_receive_skb_list_internal+0x1d9/0x1fa gro_normal_list+0x22/0x3e dev_gro_receive+0x55b/0x600 ? detach_buf_split+0x58/0x140 napi_gro_receive+0x94/0x12e virtnet_poll+0x15d/0x315 [virtio_net] __napi_poll+0x2c/0x1c9 net_rx_action+0xe6/0x1fb __do_softirq+0x115/0x2d8 run_ksoftirqd+0x18/0x20 smpboot_thread_fn+0x183/0x19c ? smpboot_unregister_percpu_thread+0x66/0x66 kthread+0x10a/0x10f ? kthread_mod_delayed_work+0xb6/0xb6 ret_from_fork+0x22/0x30 ---[ end trace 49f61b07f775fd2b ]--- dst_release: dst:00000000c02d677a refcnt:-1 dst_release underflow
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:40 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd , < 42020f7f37a90d24b9551f5f7eba3f7c7c102968 (git)
Affected: 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd , < 84fc1c944e45ab317e2e70a0e7f76fa2a5e43b6e (git)
Affected: 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd , < 79855be6445b6592bddb7bd7167083ec8cdbd73f (git)
Affected: 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd , < fc7fdd8c5c2ad2fe3e297698be9d4dbe4a4e0579 (git)
Affected: 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd , < 25053a8404ba17ca48f5553d487afc1882e9f56c (git)
Affected: 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd , < cfc579f9d89af4ada58c69b03bcaa4887840f3b3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.11
Unaffected: 0 , < 4.11 (semver)
Unaffected: 4.14.238 , ≤ 4.14.* (semver)
Unaffected: 4.19.196 , ≤ 4.19.* (semver)
Unaffected: 5.4.128 , ≤ 5.4.* (semver)
Unaffected: 5.10.46 , ≤ 5.10.* (semver)
Unaffected: 5.12.13 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.465Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/42020f7f37a90d24b9551f5f7eba3f7c7c102968"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/84fc1c944e45ab317e2e70a0e7f76fa2a5e43b6e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/79855be6445b6592bddb7bd7167083ec8cdbd73f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fc7fdd8c5c2ad2fe3e297698be9d4dbe4a4e0579"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/25053a8404ba17ca48f5553d487afc1882e9f56c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cfc579f9d89af4ada58c69b03bcaa4887840f3b3"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47222",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:40:13.415831Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:32:48.159Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_vlan_tunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "42020f7f37a90d24b9551f5f7eba3f7c7c102968",
              "status": "affected",
              "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
              "versionType": "git"
            },
            {
              "lessThan": "84fc1c944e45ab317e2e70a0e7f76fa2a5e43b6e",
              "status": "affected",
              "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
              "versionType": "git"
            },
            {
              "lessThan": "79855be6445b6592bddb7bd7167083ec8cdbd73f",
              "status": "affected",
              "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
              "versionType": "git"
            },
            {
              "lessThan": "fc7fdd8c5c2ad2fe3e297698be9d4dbe4a4e0579",
              "status": "affected",
              "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
              "versionType": "git"
            },
            {
              "lessThan": "25053a8404ba17ca48f5553d487afc1882e9f56c",
              "status": "affected",
              "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
              "versionType": "git"
            },
            {
              "lessThan": "cfc579f9d89af4ada58c69b03bcaa4887840f3b3",
              "status": "affected",
              "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_vlan_tunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.196",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.238",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.196",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.128",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.46",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.13",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix vlan tunnel dst refcnt when egressing\n\nThe egress tunnel code uses dst_clone() and directly sets the result\nwhich is wrong because the entry might have 0 refcnt or be already deleted,\ncausing number of problems. It also triggers the WARN_ON() in dst_hold()[1]\nwhen a refcnt couldn\u0027t be taken. Fix it by using dst_hold_safe() and\nchecking if a reference was actually taken before setting the dst.\n\n[1] dmesg WARN_ON log and following refcnt errors\n WARNING: CPU: 5 PID: 38 at include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]\n Modules linked in: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net\n CPU: 5 PID: 38 Comm: ksoftirqd/5 Kdump: loaded Tainted: G        W         5.13.0-rc3+ #360\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014\n RIP: 0010:br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]\n Code: e8 85 bc 01 e1 45 84 f6 74 90 45 31 f6 85 db 48 c7 c7 a0 02 19 a0 41 0f 94 c6 31 c9 31 d2 44 89 f6 e8 64 bc 01 e1 85 db 75 02 \u003c0f\u003e 0b 31 c9 31 d2 44 89 f6 48 c7 c7 70 02 19 a0 e8 4b bc 01 e1 49\n RSP: 0018:ffff8881003d39e8 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffa01902a0\n RBP: ffff8881040c6700 R08: 0000000000000000 R09: 0000000000000001\n R10: 2ce93d0054fe0d00 R11: 54fe0d00000e0000 R12: ffff888109515000\n R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000401\n FS:  0000000000000000(0000) GS:ffff88822bf40000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f42ba70f030 CR3: 0000000109926000 CR4: 00000000000006e0\n Call Trace:\n  br_handle_vlan+0xbc/0xca [bridge]\n  __br_forward+0x23/0x164 [bridge]\n  deliver_clone+0x41/0x48 [bridge]\n  br_handle_frame_finish+0x36f/0x3aa [bridge]\n  ? skb_dst+0x2e/0x38 [bridge]\n  ? br_handle_ingress_vlan_tunnel+0x3e/0x1c8 [bridge]\n  ? br_handle_frame_finish+0x3aa/0x3aa [bridge]\n  br_handle_frame+0x2c3/0x377 [bridge]\n  ? __skb_pull+0x33/0x51\n  ? vlan_do_receive+0x4f/0x36a\n  ? br_handle_frame_finish+0x3aa/0x3aa [bridge]\n  __netif_receive_skb_core+0x539/0x7c6\n  ? __list_del_entry_valid+0x16e/0x1c2\n  __netif_receive_skb_list_core+0x6d/0xd6\n  netif_receive_skb_list_internal+0x1d9/0x1fa\n  gro_normal_list+0x22/0x3e\n  dev_gro_receive+0x55b/0x600\n  ? detach_buf_split+0x58/0x140\n  napi_gro_receive+0x94/0x12e\n  virtnet_poll+0x15d/0x315 [virtio_net]\n  __napi_poll+0x2c/0x1c9\n  net_rx_action+0xe6/0x1fb\n  __do_softirq+0x115/0x2d8\n  run_ksoftirqd+0x18/0x20\n  smpboot_thread_fn+0x183/0x19c\n  ? smpboot_unregister_percpu_thread+0x66/0x66\n  kthread+0x10a/0x10f\n  ? kthread_mod_delayed_work+0xb6/0xb6\n  ret_from_fork+0x22/0x30\n ---[ end trace 49f61b07f775fd2b ]---\n dst_release: dst:00000000c02d677a refcnt:-1\n dst_release underflow"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is a race between bridge VLAN-tunnel deletion (rtnetlink RTM_SETLINK/DELLINK under RTNL) and the softirq egress path in br_handle_egress_vlan_tunnel(); a remote peer can only send frames and cannot drop tunnel_dst, so both sides must be driven locally via netlink.\nAC:L - An attacker who owns the netns controls both racing sides\u2014flooding frames through a BR_VLAN_TUNNEL port while concurrently deleting vlan tunnel info\u2014so the race is freely repeatable with no attacker-uncontrollable precondition.\nPR:L - Bridge creation, VLAN filtering, BR_VLAN_TUNNEL, and tunnel-id add/delete need only CAP_NET_ADMIN in the owning user/net namespace, which an unprivileged user obtains with unshare -Urn; real init-ns root is not required.\nUI:N - The attacker performs namespace setup, bridge/VLAN-tunnel configuration, traffic generation, and tunnel deletion entirely themselves; no victim interaction is required.\nS:U - The resulting metadata_dst use-after-free and refcnt underflow corrupt kernel heap within the same kernel security authority, with no VM/IOMMU/sandbox boundary crossed.\nC:H - dst_clone() still returns the dst after a failed hold, leaving the skb with a dangling metadata_dst that is freed via RCU; reclaiming that slab yields an arbitrary kernel-read primitive, so confidentiality impact is High.\nI:H - The dangling dst is later used for tunnel metadata on egress and released via dst_release, so an attacker-controlled reallocation provides write/corruption primitives suitable for control-flow hijack; integrity impact is High.\nA:H - The failed hold triggers WARN_ON in dst_hold(), dst_release underflow, and a softirq use-after-free that reliably oopses/panics the kernel and can be retriggered at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:47.766Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/42020f7f37a90d24b9551f5f7eba3f7c7c102968"
        },
        {
          "url": "https://git.kernel.org/stable/c/84fc1c944e45ab317e2e70a0e7f76fa2a5e43b6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/79855be6445b6592bddb7bd7167083ec8cdbd73f"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc7fdd8c5c2ad2fe3e297698be9d4dbe4a4e0579"
        },
        {
          "url": "https://git.kernel.org/stable/c/25053a8404ba17ca48f5553d487afc1882e9f56c"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfc579f9d89af4ada58c69b03bcaa4887840f3b3"
        }
      ],
      "title": "net: bridge: fix vlan tunnel dst refcnt when egressing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47222",
    "datePublished": "2024-05-21T14:19:28.214Z",
    "dateReserved": "2024-04-10T18:59:19.529Z",
    "dateUpdated": "2026-08-05T08:46:47.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47222",
      "date": "2026-09-27",
      "epss": "0.00246",
      "percentile": "0.14205"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix vlan tunnel dst refcnt when egressing\n\nThe egress tunnel code uses dst_clone() and directly sets the result\nwhich is wrong because the entry might have 0 refcnt or be already deleted,\ncausing number of problems. It also triggers the WARN_ON() in dst_hold()[1]\nwhen a refcnt couldn\u0027t be taken. Fix it by using dst_hold_safe() and\nchecking if a reference was actually taken before setting the dst.\n\n[1] dmesg WARN_ON log and following refcnt errors\n WARNING: CPU: 5 PID: 38 at include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]\n Modules linked in: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net\n CPU: 5 PID: 38 Comm: ksoftirqd/5 Kdump: loaded Tainted: G        W         5.13.0-rc3+ #360\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014\n RIP: 0010:br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]\n Code: e8 85 bc 01 e1 45 84 f6 74 90 45 31 f6 85 db 48 c7 c7 a0 02 19 a0 41 0f 94 c6 31 c9 31 d2 44 89 f6 e8 64 bc 01 e1 85 db 75 02 \u003c0f\u003e 0b 31 c9 31 d2 44 89 f6 48 c7 c7 70 02 19 a0 e8 4b bc 01 e1 49\n RSP: 0018:ffff8881003d39e8 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffa01902a0\n RBP: ffff8881040c6700 R08: 0000000000000000 R09: 0000000000000001\n R10: 2ce93d0054fe0d00 R11: 54fe0d00000e0000 R12: ffff888109515000\n R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000401\n FS:  0000000000000000(0000) GS:ffff88822bf40000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f42ba70f030 CR3: 0000000109926000 CR4: 00000000000006e0\n Call Trace:\n  br_handle_vlan+0xbc/0xca [bridge]\n  __br_forward+0x23/0x164 [bridge]\n  deliver_clone+0x41/0x48 [bridge]\n  br_handle_frame_finish+0x36f/0x3aa [bridge]\n  ? skb_dst+0x2e/0x38 [bridge]\n  ? br_handle_ingress_vlan_tunnel+0x3e/0x1c8 [bridge]\n  ? br_handle_frame_finish+0x3aa/0x3aa [bridge]\n  br_handle_frame+0x2c3/0x377 [bridge]\n  ? __skb_pull+0x33/0x51\n  ? vlan_do_receive+0x4f/0x36a\n  ? br_handle_frame_finish+0x3aa/0x3aa [bridge]\n  __netif_receive_skb_core+0x539/0x7c6\n  ? __list_del_entry_valid+0x16e/0x1c2\n  __netif_receive_skb_list_core+0x6d/0xd6\n  netif_receive_skb_list_internal+0x1d9/0x1fa\n  gro_normal_list+0x22/0x3e\n  dev_gro_receive+0x55b/0x600\n  ? detach_buf_split+0x58/0x140\n  napi_gro_receive+0x94/0x12e\n  virtnet_poll+0x15d/0x315 [virtio_net]\n  __napi_poll+0x2c/0x1c9\n  net_rx_action+0xe6/0x1fb\n  __do_softirq+0x115/0x2d8\n  run_ksoftirqd+0x18/0x20\n  smpboot_thread_fn+0x183/0x19c\n  ? smpboot_unregister_percpu_thread+0x66/0x66\n  kthread+0x10a/0x10f\n  ? kthread_mod_delayed_work+0xb6/0xb6\n  ret_from_fork+0x22/0x30\n ---[ end trace 49f61b07f775fd2b ]---\n dst_release: dst:00000000c02d677a refcnt:-1\n dst_release underflow"
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: bridge: corrige el refcnt dst del t\u00fanel vlan al salir El c\u00f3digo del t\u00fanel de salida usa dst_clone() y establece directamente el resultado que es incorrecto porque la entrada puede tener 0 refcnt o ya estar eliminada , causando varios problemas. Tambi\u00e9n activa WARN_ON() en dst_hold()[1] cuando no se puede tomar una referencia. Solucionelo usando dst_hold_safe() y verificando si realmente se tom\u00f3 una referencia antes de configurar el dst. [1] Registro dmesg WARN_ON y siguientes errores de referencia ADVERTENCIA: CPU: 5 PID: 38 en include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [puente] M\u00f3dulos vinculados en: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net CPU : 5 PID: 38 Comm: ksoftirqd/5 Kdump: cargado Contaminado: GW 5.13.0-rc3+ #360 Nombre del hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 01/04/2014 RIP: 0010:br_handle_egress_vlan_tunnel+0x10b/0x134 [puente] C\u00f3digo: e8 85 bc 01 e1 45 84 f6 74 90 45 31 f6 85 db 48 c7 c7 a0 02 19 a0 41 0f 94 c6 31 c9 31 d2 44 f6 e8 64 a.C. 01 e1 85 db 75 02 \u0026lt;0f\u0026gt; 0b 31 c9 31 d2 44 89 f6 48 c7 c7 70 02 19 a0 e8 4b bc 01 e1 49 RSP: 0018:ffff8881003d39e8 EFLAGS: 00010246 RAX: 00000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffa01902a0 RBP: ffff8881040c6700 R08: 0000000000000000 R09: 00000000000000001 R10: 2ce93d0054fe0d00 R11: d00000e0000 R12: ffff888109515000 R13: 0000000000000000 R14: 0000000000000001 R15: 00000000000000401 FS: 0000000000000000(0000) 8822bf40000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f42ba70f030 CR3: 0000000109926000 CR4: 00000000000006e0 Seguimiento de llamadas: br_handle_vlan+0xbc/0xca [puente] _forward+0x23/0x164 [puente] delivery_clone+0x41/0x48 [puente] br_handle_frame_finish+0x36f/ 0x3aa [puente] ? skb_dst+0x2e/0x38 [puente]? br_handle_ingress_vlan_tunnel+0x3e/0x1c8 [puente]? br_handle_frame_finish+0x3aa/0x3aa [puente] br_handle_frame+0x2c3/0x377 [puente]? __skb_pull+0x33/0x51? vlan_do_receive+0x4f/0x36a? br_handle_frame_finish+0x3aa/0x3aa [puente] __netif_receive_skb_core+0x539/0x7c6? __list_del_entry_valid+0x16e/0x1c2 __netif_receive_skb_list_core+0x6d/0xd6 netif_receive_skb_list_internal+0x1d9/0x1fa gro_normal_list+0x22/0x3e dev_gro_receive+0x55b/0x600 ? detach_buf_split+0x58/0x140 napi_gro_receive+0x94/0x12e virtnet_poll+0x15d/0x315 [virtio_net] __napi_poll+0x2c/0x1c9 net_rx_action+0xe6/0x1fb __do_softirq+0x115/0x2d8 run_ksoftirq d+0x18/0x20 smpboot_thread_fn+0x183/0x19c ? smpboot_unregister_percpu_thread+0x66/0x66 kthread+0x10a/0x10f? kthread_mod_delayed_work+0xb6/0xb6 ret_from_fork+0x22/0x30 ---[ end trace 49f61b07f775fd2b ]--- dst_release: dst:00000000c02d677a refcnt:-1 dst_release underflow"
        }
      ],
      "id": "CVE-2021-47222",
      "lastModified": "2024-11-21T06:35:39.383",
      "published": "2024-05-21T15:15:11.453",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/25053a8404ba17ca48f5553d487afc1882e9f56c"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/42020f7f37a90d24b9551f5f7eba3f7c7c102968"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/79855be6445b6592bddb7bd7167083ec8cdbd73f"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/84fc1c944e45ab317e2e70a0e7f76fa2a5e43b6e"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/cfc579f9d89af4ada58c69b03bcaa4887840f3b3"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/fc7fdd8c5c2ad2fe3e297698be9d4dbe4a4e0579"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/25053a8404ba17ca48f5553d487afc1882e9f56c"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/42020f7f37a90d24b9551f5f7eba3f7c7c102968"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/79855be6445b6592bddb7bd7167083ec8cdbd73f"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/84fc1c944e45ab317e2e70a0e7f76fa2a5e43b6e"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/cfc579f9d89af4ada58c69b03bcaa4887840f3b3"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/fc7fdd8c5c2ad2fe3e297698be9d4dbe4a4e0579"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/bridge/br_vlan_tunnel.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "42020f7f37a90d24b9551f5f7eba3f7c7c102968",
                    "status": "affected",
                    "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "84fc1c944e45ab317e2e70a0e7f76fa2a5e43b6e",
                    "status": "affected",
                    "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "79855be6445b6592bddb7bd7167083ec8cdbd73f",
                    "status": "affected",
                    "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fc7fdd8c5c2ad2fe3e297698be9d4dbe4a4e0579",
                    "status": "affected",
                    "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "25053a8404ba17ca48f5553d487afc1882e9f56c",
                    "status": "affected",
                    "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cfc579f9d89af4ada58c69b03bcaa4887840f3b3",
                    "status": "affected",
                    "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/bridge/br_vlan_tunnel.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.11"
                  },
                  {
                    "lessThan": "4.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.238",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.196",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.128",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.46",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.12.*",
                    "status": "unaffected",
                    "version": "5.12.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.13",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "32B54D58-21AF-4B0B-B388-EADE824369F7",
                    "versionEndExcluding": "4.14.238",
                    "versionStartIncluding": "4.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F3CAB837-7D38-4934-AD4F-195CEFD754E6",
                    "versionEndExcluding": "4.19.196",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6267BD4E-BE25-48B5-B850-4B493440DAFA",
                    "versionEndExcluding": "5.4.128",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "59455D13-A902-42E1-97F7-5ED579777193",
                    "versionEndExcluding": "5.10.46",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7806E7E5-6D4F-4E18-81C1-79B3C60EE855",
                    "versionEndExcluding": "5.12.13",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "96AC23B2-D46A-49D9-8203-8E1BEDCA8532",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "DA610E30-717C-4700-9F77-A3C9244F3BFD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "1ECD33F5-85BE-430B-8F86-8D7BD560311D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "CF351855-2437-4CF5-AD7C-BDFA51F27683",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "25A855BA-2118-44F2-90EF-EBBB12AF51EF",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix vlan tunnel dst refcnt when egressing\n\nThe egress tunnel code uses dst_clone() and directly sets the result\nwhich is wrong because the entry might have 0 refcnt or be already deleted,\ncausing number of problems. It also triggers the WARN_ON() in dst_hold()[1]\nwhen a refcnt couldn\u0027t be taken. Fix it by using dst_hold_safe() and\nchecking if a reference was actually taken before setting the dst.\n\n[1] dmesg WARN_ON log and following refcnt errors\n WARNING: CPU: 5 PID: 38 at include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]\n Modules linked in: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net\n CPU: 5 PID: 38 Comm: ksoftirqd/5 Kdump: loaded Tainted: G        W         5.13.0-rc3+ #360\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014\n RIP: 0010:br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]\n Code: e8 85 bc 01 e1 45 84 f6 74 90 45 31 f6 85 db 48 c7 c7 a0 02 19 a0 41 0f 94 c6 31 c9 31 d2 44 89 f6 e8 64 bc 01 e1 85 db 75 02 \u003c0f\u003e 0b 31 c9 31 d2 44 89 f6 48 c7 c7 70 02 19 a0 e8 4b bc 01 e1 49\n RSP: 0018:ffff8881003d39e8 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffa01902a0\n RBP: ffff8881040c6700 R08: 0000000000000000 R09: 0000000000000001\n R10: 2ce93d0054fe0d00 R11: 54fe0d00000e0000 R12: ffff888109515000\n R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000401\n FS:  0000000000000000(0000) GS:ffff88822bf40000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f42ba70f030 CR3: 0000000109926000 CR4: 00000000000006e0\n Call Trace:\n  br_handle_vlan+0xbc/0xca [bridge]\n  __br_forward+0x23/0x164 [bridge]\n  deliver_clone+0x41/0x48 [bridge]\n  br_handle_frame_finish+0x36f/0x3aa [bridge]\n  ? skb_dst+0x2e/0x38 [bridge]\n  ? br_handle_ingress_vlan_tunnel+0x3e/0x1c8 [bridge]\n  ? br_handle_frame_finish+0x3aa/0x3aa [bridge]\n  br_handle_frame+0x2c3/0x377 [bridge]\n  ? __skb_pull+0x33/0x51\n  ? vlan_do_receive+0x4f/0x36a\n  ? br_handle_frame_finish+0x3aa/0x3aa [bridge]\n  __netif_receive_skb_core+0x539/0x7c6\n  ? __list_del_entry_valid+0x16e/0x1c2\n  __netif_receive_skb_list_core+0x6d/0xd6\n  netif_receive_skb_list_internal+0x1d9/0x1fa\n  gro_normal_list+0x22/0x3e\n  dev_gro_receive+0x55b/0x600\n  ? detach_buf_split+0x58/0x140\n  napi_gro_receive+0x94/0x12e\n  virtnet_poll+0x15d/0x315 [virtio_net]\n  __napi_poll+0x2c/0x1c9\n  net_rx_action+0xe6/0x1fb\n  __do_softirq+0x115/0x2d8\n  run_ksoftirqd+0x18/0x20\n  smpboot_thread_fn+0x183/0x19c\n  ? smpboot_unregister_percpu_thread+0x66/0x66\n  kthread+0x10a/0x10f\n  ? kthread_mod_delayed_work+0xb6/0xb6\n  ret_from_fork+0x22/0x30\n ---[ end trace 49f61b07f775fd2b ]---\n dst_release: dst:00000000c02d677a refcnt:-1\n dst_release underflow"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: bridge: corrige el refcnt dst del t\u00fanel vlan al salir El c\u00f3digo del t\u00fanel de salida usa dst_clone() y establece directamente el resultado que es incorrecto porque la entrada puede tener 0 refcnt o ya estar eliminada , causando varios problemas. Tambi\u00e9n activa WARN_ON() en dst_hold()[1] cuando no se puede tomar una referencia. Solucionelo usando dst_hold_safe() y verificando si realmente se tom\u00f3 una referencia antes de configurar el dst. [1] Registro dmesg WARN_ON y siguientes errores de referencia ADVERTENCIA: CPU: 5 PID: 38 en include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [puente] M\u00f3dulos vinculados en: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net CPU : 5 PID: 38 Comm: ksoftirqd/5 Kdump: cargado Contaminado: GW 5.13.0-rc3+ #360 Nombre del hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 01/04/2014 RIP: 0010:br_handle_egress_vlan_tunnel+0x10b/0x134 [puente] C\u00f3digo: e8 85 bc 01 e1 45 84 f6 74 90 45 31 f6 85 db 48 c7 c7 a0 02 19 a0 41 0f 94 c6 31 c9 31 d2 44 f6 e8 64 a.C. 01 e1 85 db 75 02 \u0026lt;0f\u0026gt; 0b 31 c9 31 d2 44 89 f6 48 c7 c7 70 02 19 a0 e8 4b bc 01 e1 49 RSP: 0018:ffff8881003d39e8 EFLAGS: 00010246 RAX: 00000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffa01902a0 RBP: ffff8881040c6700 R08: 0000000000000000 R09: 00000000000000001 R10: 2ce93d0054fe0d00 R11: d00000e0000 R12: ffff888109515000 R13: 0000000000000000 R14: 0000000000000001 R15: 00000000000000401 FS: 0000000000000000(0000) 8822bf40000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f42ba70f030 CR3: 0000000109926000 CR4: 00000000000006e0 Seguimiento de llamadas: br_handle_vlan+0xbc/0xca [puente] _forward+0x23/0x164 [puente] delivery_clone+0x41/0x48 [puente] br_handle_frame_finish+0x36f/ 0x3aa [puente] ? skb_dst+0x2e/0x38 [puente]? br_handle_ingress_vlan_tunnel+0x3e/0x1c8 [puente]? br_handle_frame_finish+0x3aa/0x3aa [puente] br_handle_frame+0x2c3/0x377 [puente]? __skb_pull+0x33/0x51? vlan_do_receive+0x4f/0x36a? br_handle_frame_finish+0x3aa/0x3aa [puente] __netif_receive_skb_core+0x539/0x7c6? __list_del_entry_valid+0x16e/0x1c2 __netif_receive_skb_list_core+0x6d/0xd6 netif_receive_skb_list_internal+0x1d9/0x1fa gro_normal_list+0x22/0x3e dev_gro_receive+0x55b/0x600 ? detach_buf_split+0x58/0x140 napi_gro_receive+0x94/0x12e virtnet_poll+0x15d/0x315 [virtio_net] __napi_poll+0x2c/0x1c9 net_rx_action+0xe6/0x1fb __do_softirq+0x115/0x2d8 run_ksoftirq d+0x18/0x20 smpboot_thread_fn+0x183/0x19c ? smpboot_unregister_percpu_thread+0x66/0x66 kthread+0x10a/0x10f? kthread_mod_delayed_work+0xb6/0xb6 ret_from_fork+0x22/0x30 ---[ end trace 49f61b07f775fd2b ]--- dst_release: dst:00000000c02d677a refcnt:-1 dst_release underflow"
          }
        ],
        "id": "CVE-2021-47222",
        "lastModified": "2026-08-04T10:16:53.193",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47222",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:40:13.415831Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-21T15:15:11.453",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/25053a8404ba17ca48f5553d487afc1882e9f56c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/42020f7f37a90d24b9551f5f7eba3f7c7c102968"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/79855be6445b6592bddb7bd7167083ec8cdbd73f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/84fc1c944e45ab317e2e70a0e7f76fa2a5e43b6e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/cfc579f9d89af4ada58c69b03bcaa4887840f3b3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/fc7fdd8c5c2ad2fe3e297698be9d4dbe4a4e0579"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/25053a8404ba17ca48f5553d487afc1882e9f56c"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/42020f7f37a90d24b9551f5f7eba3f7c7c102968"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/79855be6445b6592bddb7bd7167083ec8cdbd73f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/84fc1c944e45ab317e2e70a0e7f76fa2a5e43b6e"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/cfc579f9d89af4ada58c69b03bcaa4887840f3b3"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/fc7fdd8c5c2ad2fe3e297698be9d4dbe4a4e0579"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:04:20+00:00",
      "cve": "CVE-2021-47222",
      "id": "CVE-2021-47222",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: bridge: fix vlan tunnel dst refcnt when egressing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47222.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:45:59Z",
      "cve": "CVE-2021-47222",
      "id": "CVE-2021-47222",
      "initial_release_date": "2024-05-23T03:05:40Z",
      "product_status:known_affected": "613",
      "product_status:known_not_affected": "213",
      "product_status:recommended": "26",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47222",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47222.json",
      "version": "38"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:32:07.465Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/42020f7f37a90d24b9551f5f7eba3f7c7c102968"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/84fc1c944e45ab317e2e70a0e7f76fa2a5e43b6e"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/79855be6445b6592bddb7bd7167083ec8cdbd73f"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/fc7fdd8c5c2ad2fe3e297698be9d4dbe4a4e0579"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/25053a8404ba17ca48f5553d487afc1882e9f56c"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/cfc579f9d89af4ada58c69b03bcaa4887840f3b3"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47222",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T15:40:13.415831Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:12.544Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/bridge/br_vlan_tunnel.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "42020f7f37a90d24b9551f5f7eba3f7c7c102968",
                  "status": "affected",
                  "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
                  "versionType": "git"
                },
                {
                  "lessThan": "84fc1c944e45ab317e2e70a0e7f76fa2a5e43b6e",
                  "status": "affected",
                  "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
                  "versionType": "git"
                },
                {
                  "lessThan": "79855be6445b6592bddb7bd7167083ec8cdbd73f",
                  "status": "affected",
                  "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
                  "versionType": "git"
                },
                {
                  "lessThan": "fc7fdd8c5c2ad2fe3e297698be9d4dbe4a4e0579",
                  "status": "affected",
                  "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
                  "versionType": "git"
                },
                {
                  "lessThan": "25053a8404ba17ca48f5553d487afc1882e9f56c",
                  "status": "affected",
                  "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
                  "versionType": "git"
                },
                {
                  "lessThan": "cfc579f9d89af4ada58c69b03bcaa4887840f3b3",
                  "status": "affected",
                  "version": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/bridge/br_vlan_tunnel.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.11"
                },
                {
                  "lessThan": "4.11",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.14.*",
                  "status": "unaffected",
                  "version": "4.14.238",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.196",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.128",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.46",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.12.*",
                  "status": "unaffected",
                  "version": "5.12.13",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.13",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.14.238",
                      "versionStartIncluding": "4.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.196",
                      "versionStartIncluding": "4.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.128",
                      "versionStartIncluding": "4.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.46",
                      "versionStartIncluding": "4.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.12.13",
                      "versionStartIncluding": "4.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.13",
                      "versionStartIncluding": "4.11",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix vlan tunnel dst refcnt when egressing\n\nThe egress tunnel code uses dst_clone() and directly sets the result\nwhich is wrong because the entry might have 0 refcnt or be already deleted,\ncausing number of problems. It also triggers the WARN_ON() in dst_hold()[1]\nwhen a refcnt couldn\u0027t be taken. Fix it by using dst_hold_safe() and\nchecking if a reference was actually taken before setting the dst.\n\n[1] dmesg WARN_ON log and following refcnt errors\n WARNING: CPU: 5 PID: 38 at include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]\n Modules linked in: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net\n CPU: 5 PID: 38 Comm: ksoftirqd/5 Kdump: loaded Tainted: G        W         5.13.0-rc3+ #360\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014\n RIP: 0010:br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]\n Code: e8 85 bc 01 e1 45 84 f6 74 90 45 31 f6 85 db 48 c7 c7 a0 02 19 a0 41 0f 94 c6 31 c9 31 d2 44 89 f6 e8 64 bc 01 e1 85 db 75 02 \u003c0f\u003e 0b 31 c9 31 d2 44 89 f6 48 c7 c7 70 02 19 a0 e8 4b bc 01 e1 49\n RSP: 0018:ffff8881003d39e8 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffa01902a0\n RBP: ffff8881040c6700 R08: 0000000000000000 R09: 0000000000000001\n R10: 2ce93d0054fe0d00 R11: 54fe0d00000e0000 R12: ffff888109515000\n R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000401\n FS:  0000000000000000(0000) GS:ffff88822bf40000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f42ba70f030 CR3: 0000000109926000 CR4: 00000000000006e0\n Call Trace:\n  br_handle_vlan+0xbc/0xca [bridge]\n  __br_forward+0x23/0x164 [bridge]\n  deliver_clone+0x41/0x48 [bridge]\n  br_handle_frame_finish+0x36f/0x3aa [bridge]\n  ? skb_dst+0x2e/0x38 [bridge]\n  ? br_handle_ingress_vlan_tunnel+0x3e/0x1c8 [bridge]\n  ? br_handle_frame_finish+0x3aa/0x3aa [bridge]\n  br_handle_frame+0x2c3/0x377 [bridge]\n  ? __skb_pull+0x33/0x51\n  ? vlan_do_receive+0x4f/0x36a\n  ? br_handle_frame_finish+0x3aa/0x3aa [bridge]\n  __netif_receive_skb_core+0x539/0x7c6\n  ? __list_del_entry_valid+0x16e/0x1c2\n  __netif_receive_skb_list_core+0x6d/0xd6\n  netif_receive_skb_list_internal+0x1d9/0x1fa\n  gro_normal_list+0x22/0x3e\n  dev_gro_receive+0x55b/0x600\n  ? detach_buf_split+0x58/0x140\n  napi_gro_receive+0x94/0x12e\n  virtnet_poll+0x15d/0x315 [virtio_net]\n  __napi_poll+0x2c/0x1c9\n  net_rx_action+0xe6/0x1fb\n  __do_softirq+0x115/0x2d8\n  run_ksoftirqd+0x18/0x20\n  smpboot_thread_fn+0x183/0x19c\n  ? smpboot_unregister_percpu_thread+0x66/0x66\n  kthread+0x10a/0x10f\n  ? kthread_mod_delayed_work+0xb6/0xb6\n  ret_from_fork+0x22/0x30\n ---[ end trace 49f61b07f775fd2b ]---\n dst_release: dst:00000000c02d677a refcnt:-1\n dst_release underflow"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The bug is a race between bridge VLAN-tunnel deletion (rtnetlink RTM_SETLINK/DELLINK under RTNL) and the softirq egress path in br_handle_egress_vlan_tunnel(); a remote peer can only send frames and cannot drop tunnel_dst, so both sides must be driven locally via netlink.\nAC:L - An attacker who owns the netns controls both racing sides\u2014flooding frames through a BR_VLAN_TUNNEL port while concurrently deleting vlan tunnel info\u2014so the race is freely repeatable with no attacker-uncontrollable precondition.\nPR:L - Bridge creation, VLAN filtering, BR_VLAN_TUNNEL, and tunnel-id add/delete need only CAP_NET_ADMIN in the owning user/net namespace, which an unprivileged user obtains with unshare -Urn; real init-ns root is not required.\nUI:N - The attacker performs namespace setup, bridge/VLAN-tunnel configuration, traffic generation, and tunnel deletion entirely themselves; no victim interaction is required.\nS:U - The resulting metadata_dst use-after-free and refcnt underflow corrupt kernel heap within the same kernel security authority, with no VM/IOMMU/sandbox boundary crossed.\nC:H - dst_clone() still returns the dst after a failed hold, leaving the skb with a dangling metadata_dst that is freed via RCU; reclaiming that slab yields an arbitrary kernel-read primitive, so confidentiality impact is High.\nI:H - The dangling dst is later used for tunnel metadata on egress and released via dst_release, so an attacker-controlled reallocation provides write/corruption primitives suitable for control-flow hijack; integrity impact is High.\nA:H - The failed hold triggers WARN_ON in dst_hold(), dst_release underflow, and a softirq use-after-free that reliably oopses/panics the kernel and can be retriggered at will."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:46:47.766Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/42020f7f37a90d24b9551f5f7eba3f7c7c102968"
            },
            {
              "url": "https://git.kernel.org/stable/c/84fc1c944e45ab317e2e70a0e7f76fa2a5e43b6e"
            },
            {
              "url": "https://git.kernel.org/stable/c/79855be6445b6592bddb7bd7167083ec8cdbd73f"
            },
            {
              "url": "https://git.kernel.org/stable/c/fc7fdd8c5c2ad2fe3e297698be9d4dbe4a4e0579"
            },
            {
              "url": "https://git.kernel.org/stable/c/25053a8404ba17ca48f5553d487afc1882e9f56c"
            },
            {
              "url": "https://git.kernel.org/stable/c/cfc579f9d89af4ada58c69b03bcaa4887840f3b3"
            }
          ],
          "title": "net: bridge: fix vlan tunnel dst refcnt when egressing",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47222",
        "datePublished": "2024-05-21T14:19:28.214Z",
        "dateReserved": "2024-04-10T18:59:19.529Z",
        "dateUpdated": "2026-08-05T08:46:47.766Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.