GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47082 (GCVE-0-2021-47082)

Vulnerability from cvelistv5 – Published: 2024-03-04 18:06 – Updated: 2026-08-05 08:45
VLAI
Title
tun: avoid double free in tun_free_netdev
Summary
In the Linux kernel, the following vulnerability has been resolved: tun: avoid double free in tun_free_netdev Avoid double free in tun_free_netdev() by moving the dev->tstats and tun->security allocs to a new ndo_init routine (tun_net_init()) that will be called by register_netdevice(). ndo_init is paired with the desctructor (tun_free_netdev()), so if there's an error in register_netdevice() the destructor will handle the frees. BUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605 CPU: 0 PID: 25750 Comm: syz-executor416 Not tainted 5.16.0-rc2-syzk #1 Hardware name: Red Hat KVM, BIOS Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106 print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:247 kasan_report_invalid_free+0x55/0x80 mm/kasan/report.c:372 ____kasan_slab_free mm/kasan/common.c:346 [inline] __kasan_slab_free+0x107/0x120 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:1723 [inline] slab_free_freelist_hook mm/slub.c:1749 [inline] slab_free mm/slub.c:3513 [inline] kfree+0xac/0x2d0 mm/slub.c:4561 selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605 security_tun_dev_free_security+0x4f/0x90 security/security.c:2342 tun_free_netdev+0xe6/0x150 drivers/net/tun.c:2215 netdev_run_todo+0x4df/0x840 net/core/dev.c:10627 rtnl_unlock+0x13/0x20 net/core/rtnetlink.c:112 __tun_chr_ioctl+0x80c/0x2870 drivers/net/tun.c:3302 tun_chr_ioctl+0x2f/0x40 drivers/net/tun.c:3311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-03-05 16:05 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 662ca437e714caaab855b12415d6ffd815985bc0 , < 8eb43d635950e27c29f1e9e49a23b31637f37757 (git)
Affected: 662ca437e714caaab855b12415d6ffd815985bc0 , < 0c0e566f0387490d16f166808c72e9c772027681 (git)
Affected: 662ca437e714caaab855b12415d6ffd815985bc0 , < a01a4e9f5dc93335c716fa4023b1901956e8c904 (git)
Affected: 662ca437e714caaab855b12415d6ffd815985bc0 , < 3cb5ae77799e8ed6ec3fec0b6b4cd07f01650cc5 (git)
Affected: 662ca437e714caaab855b12415d6ffd815985bc0 , < 158b515f703e75e7d68289bf4d98c664e1d632df (git)
Affected: a81a02460bdf054ca0c60c5aed29941f7134092d (git)
Affected: 6fc265f7a86d81e052508d03da555188f5882c3e (git)
Affected: 3.10.16 , < 3.11 (semver)
Affected: 3.11.5 , < 3.12 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 3.12
Unaffected: 0 , < 3.12 (semver)
Unaffected: 4.19.280 , ≤ 4.19.* (semver)
Unaffected: 5.4.240 , ≤ 5.4.* (semver)
Unaffected: 5.10.136 , ≤ 5.10.* (semver)
Unaffected: 5.15.12 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47082",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-05T16:05:48.438280Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:14:25.499Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:39.695Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8eb43d635950e27c29f1e9e49a23b31637f37757"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0c0e566f0387490d16f166808c72e9c772027681"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a01a4e9f5dc93335c716fa4023b1901956e8c904"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3cb5ae77799e8ed6ec3fec0b6b4cd07f01650cc5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/158b515f703e75e7d68289bf4d98c664e1d632df"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8eb43d635950e27c29f1e9e49a23b31637f37757",
              "status": "affected",
              "version": "662ca437e714caaab855b12415d6ffd815985bc0",
              "versionType": "git"
            },
            {
              "lessThan": "0c0e566f0387490d16f166808c72e9c772027681",
              "status": "affected",
              "version": "662ca437e714caaab855b12415d6ffd815985bc0",
              "versionType": "git"
            },
            {
              "lessThan": "a01a4e9f5dc93335c716fa4023b1901956e8c904",
              "status": "affected",
              "version": "662ca437e714caaab855b12415d6ffd815985bc0",
              "versionType": "git"
            },
            {
              "lessThan": "3cb5ae77799e8ed6ec3fec0b6b4cd07f01650cc5",
              "status": "affected",
              "version": "662ca437e714caaab855b12415d6ffd815985bc0",
              "versionType": "git"
            },
            {
              "lessThan": "158b515f703e75e7d68289bf4d98c664e1d632df",
              "status": "affected",
              "version": "662ca437e714caaab855b12415d6ffd815985bc0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a81a02460bdf054ca0c60c5aed29941f7134092d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6fc265f7a86d81e052508d03da555188f5882c3e",
              "versionType": "git"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.16",
              "versionType": "semver"
            },
            {
              "lessThan": "3.12",
              "status": "affected",
              "version": "3.11.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.280",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.280",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.240",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.136",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.12",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.11.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntun: avoid double free in tun_free_netdev\n\nAvoid double free in tun_free_netdev() by moving the\ndev-\u003etstats and tun-\u003esecurity allocs to a new ndo_init routine\n(tun_net_init()) that will be called by register_netdevice().\nndo_init is paired with the desctructor (tun_free_netdev()),\nso if there\u0027s an error in register_netdevice() the destructor\nwill handle the frees.\n\nBUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605\n\nCPU: 0 PID: 25750 Comm: syz-executor416 Not tainted 5.16.0-rc2-syzk #1\nHardware name: Red Hat KVM, BIOS\nCall Trace:\n\u003cTASK\u003e\n__dump_stack lib/dump_stack.c:88 [inline]\ndump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106\nprint_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:247\nkasan_report_invalid_free+0x55/0x80 mm/kasan/report.c:372\n____kasan_slab_free mm/kasan/common.c:346 [inline]\n__kasan_slab_free+0x107/0x120 mm/kasan/common.c:374\nkasan_slab_free include/linux/kasan.h:235 [inline]\nslab_free_hook mm/slub.c:1723 [inline]\nslab_free_freelist_hook mm/slub.c:1749 [inline]\nslab_free mm/slub.c:3513 [inline]\nkfree+0xac/0x2d0 mm/slub.c:4561\nselinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605\nsecurity_tun_dev_free_security+0x4f/0x90 security/security.c:2342\ntun_free_netdev+0xe6/0x150 drivers/net/tun.c:2215\nnetdev_run_todo+0x4df/0x840 net/core/dev.c:10627\nrtnl_unlock+0x13/0x20 net/core/rtnetlink.c:112\n__tun_chr_ioctl+0x80c/0x2870 drivers/net/tun.c:3302\ntun_chr_ioctl+0x2f/0x40 drivers/net/tun.c:3311\nvfs_ioctl fs/ioctl.c:51 [inline]\n__do_sys_ioctl fs/ioctl.c:874 [inline]\n__se_sys_ioctl fs/ioctl.c:860 [inline]\n__x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x44/0xae"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered via TUNSETIFF ioctl on /dev/net/tun during local tun/tap device creation in tun_set_iff(); it is not reachable from network packets or adjacent-link protocols.\nAC:L - An attacker who can create tun devices can reliably force register_netdevice() to fail after NETDEV_REGISTER (e.g., by inducing memory pressure so ipv6_add_dev/devmap notifiers return errors), hitting the broken err_detach cleanup; no race or layout outside attacker influence is required.\nPR:L - Creating a new tun/tap device only requires ns_capable(net-\u003euser_ns, CAP_NET_ADMIN), which an unprivileged user obtains via user+net namespaces (unshare -Urn); /dev/net/tun itself is typically world-openable.\nUI:N - Exploitation needs only attacker-controlled open/ioctl syscalls on /dev/net/tun; no victim action is required.\nS:U - Impact is confined to the local kernel privilege boundary (standard local memory-corruption privilege escalation); this is not a VM escape, IOMMU bypass, or other cross-authority boundary.\nC:H - The bug double-frees kernel heap objects (SELinux tun security blob and/or percpu tstats) on the register_netdevice failure path, enabling heap reuse and arbitrary kernel read primitives.\nI:H - The same double-free of tun-\u003esecurity and/or dev-\u003etstats is classic heap corruption that can be turned into arbitrary write and control-flow hijacking in the kernel.\nA:H - The double-free is reported by KASAN as an invalid free in tun_free_netdev via netdev_run_todo and can oops/panic the kernel even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:45:53.877Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8eb43d635950e27c29f1e9e49a23b31637f37757"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c0e566f0387490d16f166808c72e9c772027681"
        },
        {
          "url": "https://git.kernel.org/stable/c/a01a4e9f5dc93335c716fa4023b1901956e8c904"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cb5ae77799e8ed6ec3fec0b6b4cd07f01650cc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/158b515f703e75e7d68289bf4d98c664e1d632df"
        }
      ],
      "title": "tun: avoid double free in tun_free_netdev",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47082",
    "datePublished": "2024-03-04T18:06:17.081Z",
    "dateReserved": "2024-02-29T22:33:44.298Z",
    "dateUpdated": "2026-08-05T08:45:53.877Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47082",
      "date": "2026-09-16",
      "epss": "0.00252",
      "percentile": "0.168"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntun: avoid double free in tun_free_netdev\\n\\nAvoid double free in tun_free_netdev() by moving the\\ndev-\u003etstats and tun-\u003esecurity allocs to a new ndo_init routine\\n(tun_net_init()) that will be called by register_netdevice().\\nndo_init is paired with the desctructor (tun_free_netdev()),\\nso if there\u0027s an error in register_netdevice() the destructor\\nwill handle the frees.\\n\\nBUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605\\n\\nCPU: 0 PID: 25750 Comm: syz-executor416 Not tainted 5.16.0-rc2-syzk #1\\nHardware name: Red Hat KVM, BIOS\\nCall Trace:\\n\u003cTASK\u003e\\n__dump_stack lib/dump_stack.c:88 [inline]\\ndump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106\\nprint_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:247\\nkasan_report_invalid_free+0x55/0x80 mm/kasan/report.c:372\\n____kasan_slab_free mm/kasan/common.c:346 [inline]\\n__kasan_slab_free+0x107/0x120 mm/kasan/common.c:374\\nkasan_slab_free include/linux/kasan.h:235 [inline]\\nslab_free_hook mm/slub.c:1723 [inline]\\nslab_free_freelist_hook mm/slub.c:1749 [inline]\\nslab_free mm/slub.c:3513 [inline]\\nkfree+0xac/0x2d0 mm/slub.c:4561\\nselinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605\\nsecurity_tun_dev_free_security+0x4f/0x90 security/security.c:2342\\ntun_free_netdev+0xe6/0x150 drivers/net/tun.c:2215\\nnetdev_run_todo+0x4df/0x840 net/core/dev.c:10627\\nrtnl_unlock+0x13/0x20 net/core/rtnetlink.c:112\\n__tun_chr_ioctl+0x80c/0x2870 drivers/net/tun.c:3302\\ntun_chr_ioctl+0x2f/0x40 drivers/net/tun.c:3311\\nvfs_ioctl fs/ioctl.c:51 [inline]\\n__do_sys_ioctl fs/ioctl.c:874 [inline]\\n__se_sys_ioctl fs/ioctl.c:860 [inline]\\n__x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860\\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\\ndo_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80\\nentry_SYSCALL_64_after_hwframe+0x44/0xae\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tun: evita la doble liberaci\\u00f3n en tun_free_netdev Evita la doble liberaci\\u00f3n en tun_free_netdev() moviendo las asignaciones dev-\u0026gt;tstats y tun-\u0026gt;security a una nueva rutina ndo_init (tun_net_init()) que ser\\u00e1 llamado por Register_netdevice(). ndo_init est\\u00e1 emparejado con el destructor (tun_free_netdev()), por lo que si hay un error en Register_netdevice() el destructor manejar\\u00e1 las liberaciones. ERROR: KASAN: doble liberaci\\u00f3n o no v\\u00e1lido en selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605 CPU: 0 PID: 25750 Comm: syz-executor416 No contaminado 5.16.0-rc2-syzk #1 Nombre de hardware : Red Hat KVM, seguimiento de llamadas de BIOS:  __dump_stack lib/dump_stack.c:88 [en l\\u00ednea] dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106 print_address_description.constprop.9+0x28/0x160 mm/kasan/report. c:247 kasan_report_invalid_free+0x55/0x80 mm/kasan/report.c:372 ____kasan_slab_free mm/kasan/common.c:346 [en l\\u00ednea] __kasan_slab_free+0x107/0x120 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan .h:235 [en l\\u00ednea] slab_free_hook mm/slub.c:1723 [en l\\u00ednea] slab_free_freelist_hook mm/slub.c:1749 [en l\\u00ednea] slab_free mm/slub.c:3513 [en l\\u00ednea] kfree+0xac/0x2d0 mm/slub.c :4561 selinux_tun_dev_free_security+0x1a/0x20 seguridad/selinux/hooks.c:5605 seguridad_tun_dev_free_security+0x4f/0x90 seguridad/seguridad.c:2342 tun_free_netdev+0xe6/0x150 drivers/net/tun.c:2215 netdev_run_todo+0x4df/0x840 net/ n\\u00facleo /dev.c:10627 rtnl_unlock+0x13/0x20 net/core/rtnetlink.c:112 __tun_chr_ioctl+0x80c/0x2870 drivers/net/tun.c:3302 tun_chr_ioctl+0x2f/0x40 drivers/net/tun.c:3311 vfs_ioctl fs /ioctl.c:51 [en l\\u00ednea] __do_sys_ioctl fs/ioctl.c:874 [en l\\u00ednea] __se_sys_ioctl fs/ioctl.c:860 [en l\\u00ednea] __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/ common.c:50 [en l\\u00ednea] do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80 Entry_SYSCALL_64_after_hwframe+0x44/0xae\"}]",
      "id": "CVE-2021-47082",
      "lastModified": "2024-11-21T06:35:21.873",
      "published": "2024-03-04T18:15:07.120",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0c0e566f0387490d16f166808c72e9c772027681\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/158b515f703e75e7d68289bf4d98c664e1d632df\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/3cb5ae77799e8ed6ec3fec0b6b4cd07f01650cc5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/8eb43d635950e27c29f1e9e49a23b31637f37757\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a01a4e9f5dc93335c716fa4023b1901956e8c904\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/0c0e566f0387490d16f166808c72e9c772027681\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/158b515f703e75e7d68289bf4d98c664e1d632df\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/3cb5ae77799e8ed6ec3fec0b6b4cd07f01650cc5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/8eb43d635950e27c29f1e9e49a23b31637f37757\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a01a4e9f5dc93335c716fa4023b1901956e8c904\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Undergoing Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47082\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-03-04T18:15:07.120\",\"lastModified\":\"2026-08-04T10:16:44.640\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntun: avoid double free in tun_free_netdev\\n\\nAvoid double free in tun_free_netdev() by moving the\\ndev-\u003etstats and tun-\u003esecurity allocs to a new ndo_init routine\\n(tun_net_init()) that will be called by register_netdevice().\\nndo_init is paired with the desctructor (tun_free_netdev()),\\nso if there\u0027s an error in register_netdevice() the destructor\\nwill handle the frees.\\n\\nBUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605\\n\\nCPU: 0 PID: 25750 Comm: syz-executor416 Not tainted 5.16.0-rc2-syzk #1\\nHardware name: Red Hat KVM, BIOS\\nCall Trace:\\n\u003cTASK\u003e\\n__dump_stack lib/dump_stack.c:88 [inline]\\ndump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106\\nprint_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:247\\nkasan_report_invalid_free+0x55/0x80 mm/kasan/report.c:372\\n____kasan_slab_free mm/kasan/common.c:346 [inline]\\n__kasan_slab_free+0x107/0x120 mm/kasan/common.c:374\\nkasan_slab_free include/linux/kasan.h:235 [inline]\\nslab_free_hook mm/slub.c:1723 [inline]\\nslab_free_freelist_hook mm/slub.c:1749 [inline]\\nslab_free mm/slub.c:3513 [inline]\\nkfree+0xac/0x2d0 mm/slub.c:4561\\nselinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605\\nsecurity_tun_dev_free_security+0x4f/0x90 security/security.c:2342\\ntun_free_netdev+0xe6/0x150 drivers/net/tun.c:2215\\nnetdev_run_todo+0x4df/0x840 net/core/dev.c:10627\\nrtnl_unlock+0x13/0x20 net/core/rtnetlink.c:112\\n__tun_chr_ioctl+0x80c/0x2870 drivers/net/tun.c:3302\\ntun_chr_ioctl+0x2f/0x40 drivers/net/tun.c:3311\\nvfs_ioctl fs/ioctl.c:51 [inline]\\n__do_sys_ioctl fs/ioctl.c:874 [inline]\\n__se_sys_ioctl fs/ioctl.c:860 [inline]\\n__x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860\\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\\ndo_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80\\nentry_SYSCALL_64_after_hwframe+0x44/0xae\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tun: evita la doble liberaci\u00f3n en tun_free_netdev Evita la doble liberaci\u00f3n en tun_free_netdev() moviendo las asignaciones dev-\u0026gt;tstats y tun-\u0026gt;security a una nueva rutina ndo_init (tun_net_init()) que ser\u00e1 llamado por Register_netdevice(). ndo_init est\u00e1 emparejado con el destructor (tun_free_netdev()), por lo que si hay un error en Register_netdevice() el destructor manejar\u00e1 las liberaciones. ERROR: KASAN: doble liberaci\u00f3n o no v\u00e1lido en selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605 CPU: 0 PID: 25750 Comm: syz-executor416 No contaminado 5.16.0-rc2-syzk #1 Nombre de hardware : Red Hat KVM, seguimiento de llamadas de BIOS:  __dump_stack lib/dump_stack.c:88 [en l\u00ednea] dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106 print_address_description.constprop.9+0x28/0x160 mm/kasan/report. c:247 kasan_report_invalid_free+0x55/0x80 mm/kasan/report.c:372 ____kasan_slab_free mm/kasan/common.c:346 [en l\u00ednea] __kasan_slab_free+0x107/0x120 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan .h:235 [en l\u00ednea] slab_free_hook mm/slub.c:1723 [en l\u00ednea] slab_free_freelist_hook mm/slub.c:1749 [en l\u00ednea] slab_free mm/slub.c:3513 [en l\u00ednea] kfree+0xac/0x2d0 mm/slub.c :4561 selinux_tun_dev_free_security+0x1a/0x20 seguridad/selinux/hooks.c:5605 seguridad_tun_dev_free_security+0x4f/0x90 seguridad/seguridad.c:2342 tun_free_netdev+0xe6/0x150 drivers/net/tun.c:2215 netdev_run_todo+0x4df/0x840 net/ n\u00facleo /dev.c:10627 rtnl_unlock+0x13/0x20 net/core/rtnetlink.c:112 __tun_chr_ioctl+0x80c/0x2870 drivers/net/tun.c:3302 tun_chr_ioctl+0x2f/0x40 drivers/net/tun.c:3311 vfs_ioctl fs /ioctl.c:51 [en l\u00ednea] __do_sys_ioctl fs/ioctl.c:874 [en l\u00ednea] __se_sys_ioctl fs/ioctl.c:860 [en l\u00ednea] __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/ common.c:50 [en l\u00ednea] do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80 Entry_SYSCALL_64_after_hwframe+0x44/0xae\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/tun.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"662ca437e714caaab855b12415d6ffd815985bc0\",\"lessThan\":\"8eb43d635950e27c29f1e9e49a23b31637f37757\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"662ca437e714caaab855b12415d6ffd815985bc0\",\"lessThan\":\"0c0e566f0387490d16f166808c72e9c772027681\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"662ca437e714caaab855b12415d6ffd815985bc0\",\"lessThan\":\"a01a4e9f5dc93335c716fa4023b1901956e8c904\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"662ca437e714caaab855b12415d6ffd815985bc0\",\"lessThan\":\"3cb5ae77799e8ed6ec3fec0b6b4cd07f01650cc5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"662ca437e714caaab855b12415d6ffd815985bc0\",\"lessThan\":\"158b515f703e75e7d68289bf4d98c664e1d632df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a81a02460bdf054ca0c60c5aed29941f7134092d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6fc265f7a86d81e052508d03da555188f5882c3e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3.10.16\",\"lessThan\":\"3.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.11.5\",\"lessThan\":\"3.12\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/tun.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.280\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.240\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.136\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.12\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-03-05T16:05:48.438280Z\",\"id\":\"CVE-2021-47082\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-415\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.19.280\",\"matchCriteriaId\":\"C4B4DFEC-E739-4EBC-945F-0269BB721A1A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.240\",\"matchCriteriaId\":\"2C5F51A3-AEBF-4E51-AA58-D8C8B4554A86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.136\",\"matchCriteriaId\":\"41396D85-7E7B-44F2-A953-6C3890EC07A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.12\",\"matchCriteriaId\":\"732BA914-7B3B-43CD-857F-8119106F6F71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"357AA433-37E8-4323-BFB2-3038D6E4B414\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A73429BA-C2D9-4D0C-A75F-06A1CA8B3983\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F621B5E3-E99D-49E7-90B9-EC3B77C95383\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"F7BFDCAA-1650-49AA-8462-407DD593F94F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"6EC9882F-866D-4ACB-8FBC-213D8D8436C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A0915FE-A4AA-4C94-B783-CF29D81E7E54\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0c0e566f0387490d16f166808c72e9c772027681\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/158b515f703e75e7d68289bf4d98c664e1d632df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3cb5ae77799e8ed6ec3fec0b6b4cd07f01650cc5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8eb43d635950e27c29f1e9e49a23b31637f37757\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a01a4e9f5dc93335c716fa4023b1901956e8c904\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0c0e566f0387490d16f166808c72e9c772027681\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/158b515f703e75e7d68289bf4d98c664e1d632df\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3cb5ae77799e8ed6ec3fec0b6b4cd07f01650cc5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8eb43d635950e27c29f1e9e49a23b31637f37757\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a01a4e9f5dc93335c716fa4023b1901956e8c904\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:06:50+00:00",
      "cve": "CVE-2021-47082",
      "id": "CVE-2021-47082",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tun: avoid double free in tun_free_netdev",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47082.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T02:20:05Z",
      "cve": "CVE-2021-47082",
      "id": "CVE-2021-47082",
      "initial_release_date": "2024-03-06T04:52:30Z",
      "product_status:known_affected": "141",
      "product_status:known_not_affected": "107",
      "product_status:recommended": "468",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47082",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47082.json",
      "version": "48"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8eb43d635950e27c29f1e9e49a23b31637f37757\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0c0e566f0387490d16f166808c72e9c772027681\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a01a4e9f5dc93335c716fa4023b1901956e8c904\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3cb5ae77799e8ed6ec3fec0b6b4cd07f01650cc5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/158b515f703e75e7d68289bf4d98c664e1d632df\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:24:39.695Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47082\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-03-05T16:05:48.438280Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:15.246Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"tun: avoid double free in tun_free_netdev\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is triggered via TUNSETIFF ioctl on /dev/net/tun during local tun/tap device creation in tun_set_iff(); it is not reachable from network packets or adjacent-link protocols.\\nAC:L - An attacker who can create tun devices can reliably force register_netdevice() to fail after NETDEV_REGISTER (e.g., by inducing memory pressure so ipv6_add_dev/devmap notifiers return errors), hitting the broken err_detach cleanup; no race or layout outside attacker influence is required.\\nPR:L - Creating a new tun/tap device only requires ns_capable(net-\u003euser_ns, CAP_NET_ADMIN), which an unprivileged user obtains via user+net namespaces (unshare -Urn); /dev/net/tun itself is typically world-openable.\\nUI:N - Exploitation needs only attacker-controlled open/ioctl syscalls on /dev/net/tun; no victim action is required.\\nS:U - Impact is confined to the local kernel privilege boundary (standard local memory-corruption privilege escalation); this is not a VM escape, IOMMU bypass, or other cross-authority boundary.\\nC:H - The bug double-frees kernel heap objects (SELinux tun security blob and/or percpu tstats) on the register_netdevice failure path, enabling heap reuse and arbitrary kernel read primitives.\\nI:H - The same double-free of tun-\u003esecurity and/or dev-\u003etstats is classic heap corruption that can be turned into arbitrary write and control-flow hijacking in the kernel.\\nA:H - The double-free is reported by KASAN as an invalid free in tun_free_netdev via netdev_run_todo and can oops/panic the kernel even without full exploitation.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"662ca437e714caaab855b12415d6ffd815985bc0\", \"lessThan\": \"8eb43d635950e27c29f1e9e49a23b31637f37757\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"662ca437e714caaab855b12415d6ffd815985bc0\", \"lessThan\": \"0c0e566f0387490d16f166808c72e9c772027681\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"662ca437e714caaab855b12415d6ffd815985bc0\", \"lessThan\": \"a01a4e9f5dc93335c716fa4023b1901956e8c904\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"662ca437e714caaab855b12415d6ffd815985bc0\", \"lessThan\": \"3cb5ae77799e8ed6ec3fec0b6b4cd07f01650cc5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"662ca437e714caaab855b12415d6ffd815985bc0\", \"lessThan\": \"158b515f703e75e7d68289bf4d98c664e1d632df\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a81a02460bdf054ca0c60c5aed29941f7134092d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6fc265f7a86d81e052508d03da555188f5882c3e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3.10.16\", \"lessThan\": \"3.11\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.11.5\", \"lessThan\": \"3.12\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/net/tun.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.280\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.240\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.136\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/tun.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8eb43d635950e27c29f1e9e49a23b31637f37757\"}, {\"url\": \"https://git.kernel.org/stable/c/0c0e566f0387490d16f166808c72e9c772027681\"}, {\"url\": \"https://git.kernel.org/stable/c/a01a4e9f5dc93335c716fa4023b1901956e8c904\"}, {\"url\": \"https://git.kernel.org/stable/c/3cb5ae77799e8ed6ec3fec0b6b4cd07f01650cc5\"}, {\"url\": \"https://git.kernel.org/stable/c/158b515f703e75e7d68289bf4d98c664e1d632df\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntun: avoid double free in tun_free_netdev\\n\\nAvoid double free in tun_free_netdev() by moving the\\ndev-\u003etstats and tun-\u003esecurity allocs to a new ndo_init routine\\n(tun_net_init()) that will be called by register_netdevice().\\nndo_init is paired with the desctructor (tun_free_netdev()),\\nso if there\u0027s an error in register_netdevice() the destructor\\nwill handle the frees.\\n\\nBUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605\\n\\nCPU: 0 PID: 25750 Comm: syz-executor416 Not tainted 5.16.0-rc2-syzk #1\\nHardware name: Red Hat KVM, BIOS\\nCall Trace:\\n\u003cTASK\u003e\\n__dump_stack lib/dump_stack.c:88 [inline]\\ndump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106\\nprint_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:247\\nkasan_report_invalid_free+0x55/0x80 mm/kasan/report.c:372\\n____kasan_slab_free mm/kasan/common.c:346 [inline]\\n__kasan_slab_free+0x107/0x120 mm/kasan/common.c:374\\nkasan_slab_free include/linux/kasan.h:235 [inline]\\nslab_free_hook mm/slub.c:1723 [inline]\\nslab_free_freelist_hook mm/slub.c:1749 [inline]\\nslab_free mm/slub.c:3513 [inline]\\nkfree+0xac/0x2d0 mm/slub.c:4561\\nselinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605\\nsecurity_tun_dev_free_security+0x4f/0x90 security/security.c:2342\\ntun_free_netdev+0xe6/0x150 drivers/net/tun.c:2215\\nnetdev_run_todo+0x4df/0x840 net/core/dev.c:10627\\nrtnl_unlock+0x13/0x20 net/core/rtnetlink.c:112\\n__tun_chr_ioctl+0x80c/0x2870 drivers/net/tun.c:3302\\ntun_chr_ioctl+0x2f/0x40 drivers/net/tun.c:3311\\nvfs_ioctl fs/ioctl.c:51 [inline]\\n__do_sys_ioctl fs/ioctl.c:874 [inline]\\n__se_sys_ioctl fs/ioctl.c:860 [inline]\\n__x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860\\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\\ndo_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80\\nentry_SYSCALL_64_after_hwframe+0x44/0xae\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.280\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.240\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.136\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.12\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.10.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.11.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:45:53.877Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47082\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:45:53.877Z\", \"dateReserved\": \"2024-02-29T22:33:44.298Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-03-04T18:06:17.081Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.