CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info()
Vulnerability summary
CVE-2021-47309 is a high (CVSS 7.8) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 16.4% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 21-05-2024PublishedVulnerability first disclosed.
- 05-08-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: net: validate lwtstate->data before returning from skb_tunnel_info() skb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info type without validation. lwtstate->data can have various types such as mpls_iptunnel_encap, etc and these are not compatible. So skb_tunnel_info() should validate before returning that pointer. Splat looks like: BUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan] Read of size 2 at addr ffff888106ec2698 by task ping/811 CPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195 Call Trace: dump_stack_lvl+0x56/0x7b print_address_description.constprop.8.cold.13+0x13/0x2ee ? vxlan_get_route+0x418/0x4b0 [vxlan] ? vxlan_get_route+0x418/0x4b0 [vxlan] kasan_report.cold.14+0x83/0xdf ? vxlan_get_route+0x418/0x4b0 [vxlan] vxlan_get_route+0x418/0x4b0 [vxlan] [ ... ] vxlan_xmit_one+0x148b/0x32b0 [vxlan] [ ... ] vxlan_xmit+0x25c5/0x4780 [vxlan] [ ... ] dev_hard_start_xmit+0x1ae/0x6e0 __dev_queue_xmit+0x1f39/0x31a0 [ ... ] neigh_xmit+0x2f9/0x940 mpls_xmit+0x911/0x1600 [mpls_iptunnel] lwtunnel_xmit+0x18f/0x450 ip_finish_output2+0x867/0x2040 [ ... ]
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HDiffers
- NVDNIST7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HDiffers
EPSS trend
Probability
0.25%
Chance of exploitation in the next 30 days
Percentile
16%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.25% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu87 products
- linuxAll versions (No fix recorded) | < 4.15.0-159.167 | < 5.4.0-88.99
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 4.15.0-1112.119 | < 5.4.0-1057.60
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 61adedf3e3f1d3f032c5a6a299978d91eff6d555, < e7f3c9df40515a6c6b46f36c4c94cf48a043f887 | ≥ 61adedf3e3f1d3f032c5a6a299978d91eff6d555, < b61d327cd3cc5ea591f3bf751dd11e034f388bb5 | ≥ 61adedf3e3f1d3f032c5a6a299978d91eff6d555, < 83bdcfbd968bcc91a0632b7b625e4a9b0cba5e0d | ≥ 61adedf3e3f1d3f032c5a6a299978d91eff6d555, < 8bb1589c89e61e3b182dd546f1021928ebb5c2a6 | ≥ 61adedf3e3f1d3f032c5a6a299978d91eff6d555, < 8aa13a86964cdec4fd969ef677c6614ff068641a | ≥ 61adedf3e3f1d3f032c5a6a299978d91eff6d555, < 2179d96ec702cc33ead02a9ce40ece599b8538c5 | ≥ 61adedf3e3f1d3f032c5a6a299978d91eff6d555, < a915379594f1e045421635c6316d8f3ffa018c58 | ≥ 61adedf3e3f1d3f032c5a6a299978d91eff6d555, < 67a9c94317402b826fc3db32afc8f39336803d97 | 4.3
- linux_kernel≥ 4.3, < 4.4.277 | ≥ 4.5, < 4.9.277 | ≥ 4.10, < 4.14.241 | ≥ 4.15, < 4.19.199 | ≥ 4.20, < 5.4.135 | ≥ 5.5, < 5.10.53 | ≥ 5.11, < 5.13.5 | 5.14:rc1
Debian1 product
- linux< 5.14.6-1
3 vendors · 90 products
