GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47017 (GCVE-0-2021-47017)

Vulnerability from cvelistv5 – Published: 2024-02-28 08:13 – Updated: 2026-08-05 08:45
VLAI
Title
ath10k: Fix a use after free in ath10k_htc_send_bundle
Summary
In the Linux kernel, the following vulnerability has been resolved: ath10k: Fix a use after free in ath10k_htc_send_bundle In ath10k_htc_send_bundle, the bundle_skb could be freed by dev_kfree_skb_any(bundle_skb). But the bundle_skb is used later by bundle_skb->len. As skb_len = bundle_skb->len, my patch replaces bundle_skb->len to skb_len after the bundle_skb was freed.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:58 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c8334512f3dd1b94844baca629f9bedca4271593 , < 8bb054fb336f4250002fff4e0b075221c05c3c65 (git)
Affected: c8334512f3dd1b94844baca629f9bedca4271593 , < 3b1ac40c6012140828caa79e592a438a18ebf71b (git)
Affected: c8334512f3dd1b94844baca629f9bedca4271593 , < 5e413c0831ff4700d1739db3fa3ae9f859744676 (git)
Affected: c8334512f3dd1b94844baca629f9bedca4271593 , < 8392df5d7e0b6a7d21440da1fc259f9938f4dec3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 5.10.37 , ≤ 5.10.* (semver)
Unaffected: 5.11.21 , ≤ 5.11.* (semver)
Unaffected: 5.12.4 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:39.550Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8bb054fb336f4250002fff4e0b075221c05c3c65"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3b1ac40c6012140828caa79e592a438a18ebf71b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5e413c0831ff4700d1739db3fa3ae9f859744676"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8392df5d7e0b6a7d21440da1fc259f9938f4dec3"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47017",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:58:09.590731Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:30.771Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath10k/htc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8bb054fb336f4250002fff4e0b075221c05c3c65",
              "status": "affected",
              "version": "c8334512f3dd1b94844baca629f9bedca4271593",
              "versionType": "git"
            },
            {
              "lessThan": "3b1ac40c6012140828caa79e592a438a18ebf71b",
              "status": "affected",
              "version": "c8334512f3dd1b94844baca629f9bedca4271593",
              "versionType": "git"
            },
            {
              "lessThan": "5e413c0831ff4700d1739db3fa3ae9f859744676",
              "status": "affected",
              "version": "c8334512f3dd1b94844baca629f9bedca4271593",
              "versionType": "git"
            },
            {
              "lessThan": "8392df5d7e0b6a7d21440da1fc259f9938f4dec3",
              "status": "affected",
              "version": "c8334512f3dd1b94844baca629f9bedca4271593",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath10k/htc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.11.*",
              "status": "unaffected",
              "version": "5.11.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.37",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.21",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.4",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nath10k: Fix a use after free in ath10k_htc_send_bundle\n\nIn ath10k_htc_send_bundle, the bundle_skb could be freed by\ndev_kfree_skb_any(bundle_skb). But the bundle_skb is used later\nby bundle_skb-\u003elen.\n\nAs skb_len = bundle_skb-\u003elen, my patch replaces bundle_skb-\u003elen to\nskb_len after the bundle_skb was freed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The UAF is in the ath10k SDIO/HL WiFi HTT TX bundle path (ath10k_htc_send_hl \u2192 bundle_tx_work \u2192 ath10k_htc_send_bundle), reached when the host transmits over QCA SDIO WiFi; an in-range attacker on a hotspot/AP or busy STA link can induce that TX, so reachability is Adjacent 802.11, not routable Network or Local-only.\nAC:L - The free occurs on the documented send-failure path (credit consume returning -EAGAIN after the non-consuming build-time check, or hif_tx_sg failure), which an adjacent attacker can drive with sustained TX load; no race or layout outside attacker influence is required once bundling is active.\nPR:N - Triggering outbound WiFi TX and credit pressure needs no account or capability on the victim OS\u2014association/traffic from an adjacent peer is enough, with no CAP_NET_ADMIN or local login gate on this driver path.\nUI:N - Once the ath10k SDIO interface is up, the attacker can unilaterally generate traffic that queues bundled HTT TX; no extra victim action such as mounting a device or clicking is required.\nS:U - The dangling sk_buff access corrupts/discloses host-kernel heap state within the same kernel authority and does not cross a VM, IOMMU, or other distinct trust boundary.\nC:H - This is a use-after-free of a kmalloc-backed sk_buff (bundle_skb) after dev_kfree_skb_any; per kernel UAF guidance, reclaim of the freed object enables arbitrary kernel memory disclosure.\nI:H - The same sk_buff UAF is exploitable heap corruption that enables heap spray, arbitrary write, and control-flow hijack primitives beyond a pure crash.\nA:H - Post-free dereference of bundle_skb can oops/panic if the object/page is reclaimed or unmapped, so availability impact is High even without a full exploit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:45:36.642Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8bb054fb336f4250002fff4e0b075221c05c3c65"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b1ac40c6012140828caa79e592a438a18ebf71b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e413c0831ff4700d1739db3fa3ae9f859744676"
        },
        {
          "url": "https://git.kernel.org/stable/c/8392df5d7e0b6a7d21440da1fc259f9938f4dec3"
        }
      ],
      "title": "ath10k: Fix a use after free in ath10k_htc_send_bundle",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47017",
    "datePublished": "2024-02-28T08:13:32.739Z",
    "dateReserved": "2024-02-27T18:42:55.954Z",
    "dateUpdated": "2026-08-05T08:45:36.642Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47017",
      "date": "2026-09-19",
      "epss": "0.00339",
      "percentile": "0.27388"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "CD2F1C00-3D81-452B-AE61-0B2C1A536A1D",
                  "versionEndExcluding": "5.10.37",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "8CBB94EC-EC33-4464-99C5-03E5542715F0",
                  "versionEndExcluding": "5.11.21",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D8C7052F-1B7B-4327-9C2B-84EBF3243838",
                  "versionEndExcluding": "5.12.4",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nath10k: Fix a use after free in ath10k_htc_send_bundle\n\nIn ath10k_htc_send_bundle, the bundle_skb could be freed by\ndev_kfree_skb_any(bundle_skb). But the bundle_skb is used later\nby bundle_skb-\u003elen.\n\nAs skb_len = bundle_skb-\u003elen, my patch replaces bundle_skb-\u003elen to\nskb_len after the bundle_skb was freed."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ath10k: corrige un use after free en ath10k_htc_send_bundle En ath10k_htc_send_bundle, el paquete_skb podr\u00eda ser liberado por dev_kfree_skb_any(bundle_skb). Pero el paquete_skb lo utiliza m\u00e1s tarde el paquete_skb-\u0026gt;len. Como skb_len = bundle_skb-\u0026gt;len, mi parche reemplaza bundle_skb-\u0026gt;len por skb_len despu\u00e9s de que se liber\u00f3 el paquete_skb."
        }
      ],
      "id": "CVE-2021-47017",
      "lastModified": "2024-12-09T17:59:26.630",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-02-28T09:15:38.960",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/3b1ac40c6012140828caa79e592a438a18ebf71b"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/5e413c0831ff4700d1739db3fa3ae9f859744676"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/8392df5d7e0b6a7d21440da1fc259f9938f4dec3"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/8bb054fb336f4250002fff4e0b075221c05c3c65"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/3b1ac40c6012140828caa79e592a438a18ebf71b"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/5e413c0831ff4700d1739db3fa3ae9f859744676"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/8392df5d7e0b6a7d21440da1fc259f9938f4dec3"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/8bb054fb336f4250002fff4e0b075221c05c3c65"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-416"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/ath/ath10k/htc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8bb054fb336f4250002fff4e0b075221c05c3c65",
                    "status": "affected",
                    "version": "c8334512f3dd1b94844baca629f9bedca4271593",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3b1ac40c6012140828caa79e592a438a18ebf71b",
                    "status": "affected",
                    "version": "c8334512f3dd1b94844baca629f9bedca4271593",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5e413c0831ff4700d1739db3fa3ae9f859744676",
                    "status": "affected",
                    "version": "c8334512f3dd1b94844baca629f9bedca4271593",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8392df5d7e0b6a7d21440da1fc259f9938f4dec3",
                    "status": "affected",
                    "version": "c8334512f3dd1b94844baca629f9bedca4271593",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/ath/ath10k/htc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.8"
                  },
                  {
                    "lessThan": "5.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.37",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.11.*",
                    "status": "unaffected",
                    "version": "5.11.21",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.12.*",
                    "status": "unaffected",
                    "version": "5.12.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.13",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CD2F1C00-3D81-452B-AE61-0B2C1A536A1D",
                    "versionEndExcluding": "5.10.37",
                    "versionStartIncluding": "5.8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8CBB94EC-EC33-4464-99C5-03E5542715F0",
                    "versionEndExcluding": "5.11.21",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D8C7052F-1B7B-4327-9C2B-84EBF3243838",
                    "versionEndExcluding": "5.12.4",
                    "versionStartIncluding": "5.12",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nath10k: Fix a use after free in ath10k_htc_send_bundle\n\nIn ath10k_htc_send_bundle, the bundle_skb could be freed by\ndev_kfree_skb_any(bundle_skb). But the bundle_skb is used later\nby bundle_skb-\u003elen.\n\nAs skb_len = bundle_skb-\u003elen, my patch replaces bundle_skb-\u003elen to\nskb_len after the bundle_skb was freed."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ath10k: corrige un use after free en ath10k_htc_send_bundle En ath10k_htc_send_bundle, el paquete_skb podr\u00eda ser liberado por dev_kfree_skb_any(bundle_skb). Pero el paquete_skb lo utiliza m\u00e1s tarde el paquete_skb-\u0026gt;len. Como skb_len = bundle_skb-\u0026gt;len, mi parche reemplaza bundle_skb-\u0026gt;len por skb_len despu\u00e9s de que se liber\u00f3 el paquete_skb."
          }
        ],
        "id": "CVE-2021-47017",
        "lastModified": "2026-08-04T10:16:41.900",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47017",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:58:09.590731Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-02-28T09:15:38.960",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3b1ac40c6012140828caa79e592a438a18ebf71b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5e413c0831ff4700d1739db3fa3ae9f859744676"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8392df5d7e0b6a7d21440da1fc259f9938f4dec3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8bb054fb336f4250002fff4e0b075221c05c3c65"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3b1ac40c6012140828caa79e592a438a18ebf71b"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5e413c0831ff4700d1739db3fa3ae9f859744676"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8392df5d7e0b6a7d21440da1fc259f9938f4dec3"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8bb054fb336f4250002fff4e0b075221c05c3c65"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T20:06:42+00:00",
      "cve": "CVE-2021-47017",
      "id": "CVE-2021-47017",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: use after free in ath10k_htc_send_bundle",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47017.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-04T00:44:26Z",
      "cve": "CVE-2021-47017",
      "id": "CVE-2021-47017",
      "initial_release_date": "2024-03-01T04:07:55Z",
      "product_status:known_affected": "388",
      "product_status:known_not_affected": "320",
      "product_status:recommended": "91",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47017",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47017.json",
      "version": "41"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:24:39.550Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/8bb054fb336f4250002fff4e0b075221c05c3c65"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/3b1ac40c6012140828caa79e592a438a18ebf71b"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/5e413c0831ff4700d1739db3fa3ae9f859744676"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/8392df5d7e0b6a7d21440da1fc259f9938f4dec3"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47017",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T15:58:09.590731Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:17.072Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/wireless/ath/ath10k/htc.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "8bb054fb336f4250002fff4e0b075221c05c3c65",
                  "status": "affected",
                  "version": "c8334512f3dd1b94844baca629f9bedca4271593",
                  "versionType": "git"
                },
                {
                  "lessThan": "3b1ac40c6012140828caa79e592a438a18ebf71b",
                  "status": "affected",
                  "version": "c8334512f3dd1b94844baca629f9bedca4271593",
                  "versionType": "git"
                },
                {
                  "lessThan": "5e413c0831ff4700d1739db3fa3ae9f859744676",
                  "status": "affected",
                  "version": "c8334512f3dd1b94844baca629f9bedca4271593",
                  "versionType": "git"
                },
                {
                  "lessThan": "8392df5d7e0b6a7d21440da1fc259f9938f4dec3",
                  "status": "affected",
                  "version": "c8334512f3dd1b94844baca629f9bedca4271593",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/wireless/ath/ath10k/htc.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.8"
                },
                {
                  "lessThan": "5.8",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.37",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.11.*",
                  "status": "unaffected",
                  "version": "5.11.21",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.12.*",
                  "status": "unaffected",
                  "version": "5.12.4",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.13",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.37",
                      "versionStartIncluding": "5.8",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.11.21",
                      "versionStartIncluding": "5.8",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.12.4",
                      "versionStartIncluding": "5.8",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.13",
                      "versionStartIncluding": "5.8",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nath10k: Fix a use after free in ath10k_htc_send_bundle\n\nIn ath10k_htc_send_bundle, the bundle_skb could be freed by\ndev_kfree_skb_any(bundle_skb). But the bundle_skb is used later\nby bundle_skb-\u003elen.\n\nAs skb_len = bundle_skb-\u003elen, my patch replaces bundle_skb-\u003elen to\nskb_len after the bundle_skb was freed."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:A - The UAF is in the ath10k SDIO/HL WiFi HTT TX bundle path (ath10k_htc_send_hl \u2192 bundle_tx_work \u2192 ath10k_htc_send_bundle), reached when the host transmits over QCA SDIO WiFi; an in-range attacker on a hotspot/AP or busy STA link can induce that TX, so reachability is Adjacent 802.11, not routable Network or Local-only.\nAC:L - The free occurs on the documented send-failure path (credit consume returning -EAGAIN after the non-consuming build-time check, or hif_tx_sg failure), which an adjacent attacker can drive with sustained TX load; no race or layout outside attacker influence is required once bundling is active.\nPR:N - Triggering outbound WiFi TX and credit pressure needs no account or capability on the victim OS\u2014association/traffic from an adjacent peer is enough, with no CAP_NET_ADMIN or local login gate on this driver path.\nUI:N - Once the ath10k SDIO interface is up, the attacker can unilaterally generate traffic that queues bundled HTT TX; no extra victim action such as mounting a device or clicking is required.\nS:U - The dangling sk_buff access corrupts/discloses host-kernel heap state within the same kernel authority and does not cross a VM, IOMMU, or other distinct trust boundary.\nC:H - This is a use-after-free of a kmalloc-backed sk_buff (bundle_skb) after dev_kfree_skb_any; per kernel UAF guidance, reclaim of the freed object enables arbitrary kernel memory disclosure.\nI:H - The same sk_buff UAF is exploitable heap corruption that enables heap spray, arbitrary write, and control-flow hijack primitives beyond a pure crash.\nA:H - Post-free dereference of bundle_skb can oops/panic if the object/page is reclaimed or unmapped, so availability impact is High even without a full exploit."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:45:36.642Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/8bb054fb336f4250002fff4e0b075221c05c3c65"
            },
            {
              "url": "https://git.kernel.org/stable/c/3b1ac40c6012140828caa79e592a438a18ebf71b"
            },
            {
              "url": "https://git.kernel.org/stable/c/5e413c0831ff4700d1739db3fa3ae9f859744676"
            },
            {
              "url": "https://git.kernel.org/stable/c/8392df5d7e0b6a7d21440da1fc259f9938f4dec3"
            }
          ],
          "title": "ath10k: Fix a use after free in ath10k_htc_send_bundle",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47017",
        "datePublished": "2024-02-28T08:13:32.739Z",
        "dateReserved": "2024-02-27T18:42:55.954Z",
        "dateUpdated": "2026-08-05T08:45:36.642Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.