GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47201 (GCVE-0-2021-47201)

Vulnerability from cvelistv5 – Published: 2024-04-10 18:56 – Updated: 2026-08-05 08:46
VLAI
Title
iavf: free q_vectors before queues in iavf_disable_vf
Summary
In the Linux kernel, the following vulnerability has been resolved: iavf: free q_vectors before queues in iavf_disable_vf iavf_free_queues() clears adapter->num_active_queues, which iavf_free_q_vectors() relies on, so swap the order of these two function calls in iavf_disable_vf(). This resolves a panic encountered when the interface is disabled and then later brought up again after PF communication is restored.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-10 19:51 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 65c7006f234c9ede887d468f595f259a5c5cc552 , < 926e8c83d4c1c2dac0026637eb0d492df876489e (git)
Affected: 65c7006f234c9ede887d468f595f259a5c5cc552 , < 78638b47132244e3934dc5dc79f6372d5ce8e98c (git)
Affected: 65c7006f234c9ede887d468f595f259a5c5cc552 , < 9ef6589cac9a8c47f5544ccdf4c498093733bb3f (git)
Affected: 65c7006f234c9ede887d468f595f259a5c5cc552 , < 89f22f129696ab53cfbc608e0a2184d0fea46ac1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.13
Unaffected: 0 , < 4.13 (semver)
Unaffected: 5.4.162 , ≤ 5.4.* (semver)
Unaffected: 5.10.82 , ≤ 5.10.* (semver)
Unaffected: 5.15.5 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47201",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-10T19:51:02.253151Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:14:25.949Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.396Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/926e8c83d4c1c2dac0026637eb0d492df876489e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/78638b47132244e3934dc5dc79f6372d5ce8e98c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9ef6589cac9a8c47f5544ccdf4c498093733bb3f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/89f22f129696ab53cfbc608e0a2184d0fea46ac1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/iavf/iavf_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "926e8c83d4c1c2dac0026637eb0d492df876489e",
              "status": "affected",
              "version": "65c7006f234c9ede887d468f595f259a5c5cc552",
              "versionType": "git"
            },
            {
              "lessThan": "78638b47132244e3934dc5dc79f6372d5ce8e98c",
              "status": "affected",
              "version": "65c7006f234c9ede887d468f595f259a5c5cc552",
              "versionType": "git"
            },
            {
              "lessThan": "9ef6589cac9a8c47f5544ccdf4c498093733bb3f",
              "status": "affected",
              "version": "65c7006f234c9ede887d468f595f259a5c5cc552",
              "versionType": "git"
            },
            {
              "lessThan": "89f22f129696ab53cfbc608e0a2184d0fea46ac1",
              "status": "affected",
              "version": "65c7006f234c9ede887d468f595f259a5c5cc552",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/iavf/iavf_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.162",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.82",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.5",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: free q_vectors before queues in iavf_disable_vf\n\niavf_free_queues() clears adapter-\u003enum_active_queues, which\niavf_free_q_vectors() relies on, so swap the order of these two function\ncalls in iavf_disable_vf(). This resolves a panic encountered when the\ninterface is disabled and then later brought up again after PF\ncommunication is restored."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the iavf VF driver\u2019s local reset/disable path (iavf_reset_task \u2192 iavf_disable_vf \u2192 iavf_free_q_vectors), reached via local netdev operations such as MTU/ethtool-driven resets or PF-reset handling\u2014not by processing remote packets.\nAC:L - Once iavf_disable_vf runs, freeing q_vectors without netif_napi_del is fully deterministic with no race to win. A local actor can repeatedly schedule VF resets, and in the worst reasonable SR-IOV deployment PF communication failures/restoration (the commit\u2019s own scenario) make this path reachable under attacker-driven reset pressure.\nPR:L - Triggering the reset/reopen path only requires CAP_NET_ADMIN in the netns that owns the VF (e.g. ip link set mtu / ifup). SR-IOV VFs are routinely delegated into tenant/container netnses where that capability is available via user namespaces without init-namespace root.\nUI:N - The attacker schedules resets and can bring the interface back up after PF communication is restored (or recovery proceeds via the watchdog); no separate victim action is required.\nS:U - The dangling napi_struct UAF corrupts kernel heap within the same OS authority that runs iavf. This is standard local kernel compromise/DoS, not a guest-to-host escape or IOMMU boundary bypass.\nC:H - q_vectors (containing napi_structs) are kfree\u2019d while still linked on netdev-\u003enapi_list, leaving dangling pointers. An attacker can reoccupy the freed object; subsequent NAPI list walks read attacker-controlled state (as in the related iavf NAPI UAF CVE-2023-53556), enabling high confidentiality impact.\nI:H - Later napi_del/list walks perform list_del_rcu and related writes on the freed napi_struct, yielding arbitrary-write primitives via forged next/prev pointers, sufficient for control-flow hijacking under kernel UAF guidance.\nA:H - The commit documents a kernel panic when the interface is brought back up after PF communication is restored; any walk of the corrupted napi_list (reinit, free_netdev, etc.) can oops/panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:42.381Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/926e8c83d4c1c2dac0026637eb0d492df876489e"
        },
        {
          "url": "https://git.kernel.org/stable/c/78638b47132244e3934dc5dc79f6372d5ce8e98c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ef6589cac9a8c47f5544ccdf4c498093733bb3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/89f22f129696ab53cfbc608e0a2184d0fea46ac1"
        }
      ],
      "title": "iavf: free q_vectors before queues in iavf_disable_vf",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47201",
    "datePublished": "2024-04-10T18:56:35.774Z",
    "dateReserved": "2024-03-25T09:12:14.117Z",
    "dateUpdated": "2026-08-05T08:46:42.381Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47201",
      "date": "2026-09-16",
      "epss": "0.00245",
      "percentile": "0.15857"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\niavf: free q_vectors before queues in iavf_disable_vf\\n\\niavf_free_queues() clears adapter-\u003enum_active_queues, which\\niavf_free_q_vectors() relies on, so swap the order of these two function\\ncalls in iavf_disable_vf(). This resolves a panic encountered when the\\ninterface is disabled and then later brought up again after PF\\ncommunication is restored.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iavf: libera q_vectors antes de las colas en iavf_disable_vf iavf_free_queues() borra adaptador-\u0026gt;num_active_queues, del que depende iavf_free_q_vectors(), por lo que se debe intercambiar el orden de estas dos llamadas de funci\\u00f3n en iavf_disable_vf(). Esto resuelve un p\\u00e1nico que se produce cuando se deshabilita la interfaz y luego se vuelve a activar despu\\u00e9s de que se restablece la comunicaci\\u00f3n PF.\"}]",
      "id": "CVE-2021-47201",
      "lastModified": "2024-11-21T06:35:37.100",
      "published": "2024-04-10T19:15:48.123",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/78638b47132244e3934dc5dc79f6372d5ce8e98c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/89f22f129696ab53cfbc608e0a2184d0fea46ac1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/926e8c83d4c1c2dac0026637eb0d492df876489e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9ef6589cac9a8c47f5544ccdf4c498093733bb3f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/78638b47132244e3934dc5dc79f6372d5ce8e98c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/89f22f129696ab53cfbc608e0a2184d0fea46ac1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/926e8c83d4c1c2dac0026637eb0d492df876489e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/9ef6589cac9a8c47f5544ccdf4c498093733bb3f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47201\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-10T19:15:48.123\",\"lastModified\":\"2026-08-04T10:16:52.383\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niavf: free q_vectors before queues in iavf_disable_vf\\n\\niavf_free_queues() clears adapter-\u003enum_active_queues, which\\niavf_free_q_vectors() relies on, so swap the order of these two function\\ncalls in iavf_disable_vf(). This resolves a panic encountered when the\\ninterface is disabled and then later brought up again after PF\\ncommunication is restored.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iavf: libera q_vectors antes de las colas en iavf_disable_vf iavf_free_queues() borra adaptador-\u0026gt;num_active_queues, del que depende iavf_free_q_vectors(), por lo que se debe intercambiar el orden de estas dos llamadas de funci\u00f3n en iavf_disable_vf(). Esto resuelve un p\u00e1nico que se produce cuando se deshabilita la interfaz y luego se vuelve a activar despu\u00e9s de que se restablece la comunicaci\u00f3n PF.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/intel/iavf/iavf_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"65c7006f234c9ede887d468f595f259a5c5cc552\",\"lessThan\":\"926e8c83d4c1c2dac0026637eb0d492df876489e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"65c7006f234c9ede887d468f595f259a5c5cc552\",\"lessThan\":\"78638b47132244e3934dc5dc79f6372d5ce8e98c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"65c7006f234c9ede887d468f595f259a5c5cc552\",\"lessThan\":\"9ef6589cac9a8c47f5544ccdf4c498093733bb3f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"65c7006f234c9ede887d468f595f259a5c5cc552\",\"lessThan\":\"89f22f129696ab53cfbc608e0a2184d0fea46ac1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/intel/iavf/iavf_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.162\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.82\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.5\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-04-10T19:51:02.253151Z\",\"id\":\"CVE-2021-47201\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.13\",\"versionEndExcluding\":\"5.4.162\",\"matchCriteriaId\":\"CAAC333B-58DB-4C4B-98C7-032C07430D26\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.82\",\"matchCriteriaId\":\"AE501832-500C-4EF1-9489-5C13674F619D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.5\",\"matchCriteriaId\":\"2128A085-4C0C-4C1E-9E9C-0DD868E2170F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"357AA433-37E8-4323-BFB2-3038D6E4B414\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/78638b47132244e3934dc5dc79f6372d5ce8e98c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/89f22f129696ab53cfbc608e0a2184d0fea46ac1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/926e8c83d4c1c2dac0026637eb0d492df876489e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9ef6589cac9a8c47f5544ccdf4c498093733bb3f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78638b47132244e3934dc5dc79f6372d5ce8e98c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/89f22f129696ab53cfbc608e0a2184d0fea46ac1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/926e8c83d4c1c2dac0026637eb0d492df876489e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9ef6589cac9a8c47f5544ccdf4c498093733bb3f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:04:30+00:00",
      "cve": "CVE-2021-47201",
      "id": "CVE-2021-47201",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "122",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iavf: free q_vectors before queues in iavf_disable_vf",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47201.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:40:08Z",
      "cve": "CVE-2021-47201",
      "id": "CVE-2021-47201",
      "initial_release_date": "2024-04-15T23:20:42Z",
      "product_status:known_affected": "265",
      "product_status:known_not_affected": "204",
      "product_status:recommended": "667",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47201",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47201.json",
      "version": "70"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/926e8c83d4c1c2dac0026637eb0d492df876489e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/78638b47132244e3934dc5dc79f6372d5ce8e98c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9ef6589cac9a8c47f5544ccdf4c498093733bb3f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/89f22f129696ab53cfbc608e0a2184d0fea46ac1\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:07.396Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47201\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-10T19:51:02.253151Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:23.145Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"iavf: free q_vectors before queues in iavf_disable_vf\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is in the iavf VF driver\\u2019s local reset/disable path (iavf_reset_task \\u2192 iavf_disable_vf \\u2192 iavf_free_q_vectors), reached via local netdev operations such as MTU/ethtool-driven resets or PF-reset handling\\u2014not by processing remote packets.\\nAC:L - Once iavf_disable_vf runs, freeing q_vectors without netif_napi_del is fully deterministic with no race to win. A local actor can repeatedly schedule VF resets, and in the worst reasonable SR-IOV deployment PF communication failures/restoration (the commit\\u2019s own scenario) make this path reachable under attacker-driven reset pressure.\\nPR:L - Triggering the reset/reopen path only requires CAP_NET_ADMIN in the netns that owns the VF (e.g. ip link set mtu / ifup). SR-IOV VFs are routinely delegated into tenant/container netnses where that capability is available via user namespaces without init-namespace root.\\nUI:N - The attacker schedules resets and can bring the interface back up after PF communication is restored (or recovery proceeds via the watchdog); no separate victim action is required.\\nS:U - The dangling napi_struct UAF corrupts kernel heap within the same OS authority that runs iavf. This is standard local kernel compromise/DoS, not a guest-to-host escape or IOMMU boundary bypass.\\nC:H - q_vectors (containing napi_structs) are kfree\\u2019d while still linked on netdev-\u003enapi_list, leaving dangling pointers. An attacker can reoccupy the freed object; subsequent NAPI list walks read attacker-controlled state (as in the related iavf NAPI UAF CVE-2023-53556), enabling high confidentiality impact.\\nI:H - Later napi_del/list walks perform list_del_rcu and related writes on the freed napi_struct, yielding arbitrary-write primitives via forged next/prev pointers, sufficient for control-flow hijacking under kernel UAF guidance.\\nA:H - The commit documents a kernel panic when the interface is brought back up after PF communication is restored; any walk of the corrupted napi_list (reinit, free_netdev, etc.) can oops/panic the kernel.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"65c7006f234c9ede887d468f595f259a5c5cc552\", \"lessThan\": \"926e8c83d4c1c2dac0026637eb0d492df876489e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"65c7006f234c9ede887d468f595f259a5c5cc552\", \"lessThan\": \"78638b47132244e3934dc5dc79f6372d5ce8e98c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"65c7006f234c9ede887d468f595f259a5c5cc552\", \"lessThan\": \"9ef6589cac9a8c47f5544ccdf4c498093733bb3f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"65c7006f234c9ede887d468f595f259a5c5cc552\", \"lessThan\": \"89f22f129696ab53cfbc608e0a2184d0fea46ac1\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/intel/iavf/iavf_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.82\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/intel/iavf/iavf_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/926e8c83d4c1c2dac0026637eb0d492df876489e\"}, {\"url\": \"https://git.kernel.org/stable/c/78638b47132244e3934dc5dc79f6372d5ce8e98c\"}, {\"url\": \"https://git.kernel.org/stable/c/9ef6589cac9a8c47f5544ccdf4c498093733bb3f\"}, {\"url\": \"https://git.kernel.org/stable/c/89f22f129696ab53cfbc608e0a2184d0fea46ac1\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\niavf: free q_vectors before queues in iavf_disable_vf\\n\\niavf_free_queues() clears adapter-\u003enum_active_queues, which\\niavf_free_q_vectors() relies on, so swap the order of these two function\\ncalls in iavf_disable_vf(). This resolves a panic encountered when the\\ninterface is disabled and then later brought up again after PF\\ncommunication is restored.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.162\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.82\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.5\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"4.13\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:46:42.381Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47201\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:46:42.381Z\", \"dateReserved\": \"2024-03-25T09:12:14.117Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-10T18:56:35.774Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.