PT-2024-11178 · Linux · Linux Kernel

Published 2021-06-03 · Updated 2025-01-07 · CVE-2021-47127

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.12.0-rc2+ #45

Description A vulnerability in the Linux kernel has been resolved, which was introduced by a commit that removed the xsk buff pool from the VSI structure. This change broke the Tx side of AF XDP in copy mode, causing a kernel NULL pointer dereference when xdpsock is run in txonly or l2fwd scenarios. The issue occurs because the xsk pool on ice ring is set only based on the existence of the XDP prog on the VSI, which in turn picks the wrong napi poll routine. To fix this, a bitmap of queues that are zero-copy enabled is introduced, where each bit corresponds to a queue id that the xsk pool is being configured on. This bitmap is set and cleared within the ice xsk pool {en,dis}able functions and checked within the ice xsk pool() function.

Recommendations To resolve this issue, update the Linux kernel to a version that includes the fix for this vulnerability. Specifically, update to a version later than 5.12.0-rc2+ #45. As a temporary workaround, consider disabling the use of AF XDP in copy mode until the update can be applied.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2025-07283

CVE-2021-47127

Affected Products

Linux Kernel

References · 13

• https://git.kernel.org/stable/c/e102db780e1c14f10c70dafa7684af22a745b51d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-47127 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-47127 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-47127 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-07283 · Security Note
• https://osv.dev/vulnerability/CVE-2021-47127 · Vendor Advisory
• https://git.kernel.org/stable/c/1d34fa4fcf06649036ba0c97854fcf7a741ee18c · Patch
• https://ubuntu.com/security/CVE-2021-47127 · Vendor Advisory
• https://lore.kernel.org/linux-cve-announce/2024031512-CVE-2021-47127-d0d6@gregkh · Note
• https://twitter.com/CVEnew/status/1768738331200999912 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47127 · Note
• https://git.kernel.org/linus/e102db780e1c14f10c70dafa7684af22a745b51d · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.10 · Note