Every CVESearch/Get API key

CVE-2021-46954

net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packets

7.1 High

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packets

when 'act_mirred' tries to fragment IPv4 packets that had been previously re-assembled using 'act_ct', splats like the following can be observed on kernels built with KASAN:

BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60 Read of size 1 at addr ffff888147009574 by task ping/947

CPU: 0 PID: 947 Comm: ping Not tainted 5.12.0-rc6+ #418 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 Call Trace: <IRQ> dump_stack+0x92/0xc1 print_address_description.constprop.7+0x1a/0x150 kasan_report.cold.13+0x7f/0x111 ip_do_fragment+0x1b03/0x1f60 sch_fragment+0x4bf/0xe40 tcf_mirred_act+0xc3d/0x11a0 [act_mirred] tcf_action_exec+0x104/0x3e0 fl_classify+0x49a/0x5e0 [cls_flower] tcf_classify_ingress+0x18a/0x820 __netif_receive_skb_core+0xae7/0x3340 __netif_receive_skb_one_core+0xb6/0x1b0 process_backlog+0x1ef/0x6c0 __napi_poll+0xaa/0x500 net_rx_action+0x702/0xac0 __do_softirq+0x1e4/0x97f do_softirq+0x71/0x90 </IRQ> __local_bh_enable_ip+0xdb/0xf0 ip_finish_output2+0x760/0x2120 ip_do_fragment+0x15a5/0x1f60 __ip_finish_output+0x4c2/0xea0 ip_output+0x1ca/0x4d0 ip_send_skb+0x37/0xa0 raw_sendmsg+0x1c4b/0x2d00 sock_sendmsg+0xdb/0x110 __sys_sendto+0x1d7/0x2b0 __x64_sys_sendto+0xdd/0x1b0 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f82e13853eb Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 75 42 2c 00 41 89 ca 8b 00 85 c0 75 14 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 75 c3 0f 1f 40 00 41 57 4d 89 c7 41 56 41 89 RSP: 002b:00007ffe01fad888 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00005571aac13700 RCX: 00007f82e13853eb RDX: 0000000000002330 RSI: 00005571aac13700 RDI: 0000000000000003 RBP: 0000000000002330 R08: 00005571aac10500 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe01faefb0 R13: 00007ffe01fad890 R14: 00007ffe01fad980 R15: 00005571aac0f0a0

The buggy address belongs to the page: page:000000001dff2e03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x147009 flags: 0x17ffffc0001000(reserved) raw: 0017ffffc0001000 ffffea00051c0248 ffffea00051c0248 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected

Memory state around the buggy address: ffff888147009400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888147009480: f1 f1 f1 f1 04 f2 f2 f2 f2 f2 f2 f2 00 00 00 00

ffff888147009500: 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 f2 ^ ffff888147009580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888147009600: 00 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2

for IPv4 packets, sch_fragment() uses a temporary struct dst_entry. Then, in the following call graph:

ip_do_fragment() ip_skb_dst_mtu() ip_dst_mtu_maybe_forward() ip_mtu_locked()

the pointer to struct dst_entry is used as pointer to struct rtable: this turns the access to struct members like rt_mtu_locked into an OOB read in the stack. Fix this changing the temporary variable used for IPv4 packets in sch_fragment(), similarly to what is done for IPv6 few lines below.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
High

Exploit likelihood

0.23%Up 0.2 points since Feb 28, 2024
90%50%10%1%

What each source reports

NVD Score used7.1

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packets

when 'act_mirred' tries to fragment IPv4 packets that had been previously re-assembled using 'act_ct', splats like the following can be observed on kernels built with KASAN:

BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60 Read of size 1 at addr ffff888147009574 by task ping/947

CPU: 0 PID: 947 Comm: ping Not tainted 5.12.0-rc6+ #418 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 Call Trace: <IRQ> dump_stack+0x92/0xc1 print_address_description.constprop.7+0x1a/0x150 kasan_report.cold.13+0x7f/0x111 ip_do_fragment+0x1b03/0x1f60 sch_fragment+0x4bf/0xe40 tcf_mirred_act+0xc3d/0x11a0 [act_mirred] tcf_action_exec+0x104/0x3e0 fl_classify+0x49a/0x5e0 [cls_flower] tcf_classify_ingress+0x18a/0x820 __netif_receive_skb_core+0xae7/0x3340 __netif_receive_skb_one_core+0xb6/0x1b0 process_backlog+0x1ef/0x6c0 __napi_poll+0xaa/0x500 net_rx_action+0x702/0xac0 __do_softirq+0x1e4/0x97f do_softirq+0x71/0x90 </IRQ> __local_bh_enable_ip+0xdb/0xf0 ip_finish_output2+0x760/0x2120 ip_do_fragment+0x15a5/0x1f60 __ip_finish_output+0x4c2/0xea0 ip_output+0x1ca/0x4d0 ip_send_skb+0x37/0xa0 raw_sendmsg+0x1c4b/0x2d00 sock_sendmsg+0xdb/0x110 __sys_sendto+0x1d7/0x2b0 __x64_sys_sendto+0xdd/0x1b0 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f82e13853eb Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 75 42 2c 00 41 89 ca 8b 00 85 c0 75 14 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 75 c3 0f 1f 40 00 41 57 4d 89 c7 41 56 41 89 RSP: 002b:00007ffe01fad888 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00005571aac13700 RCX: 00007f82e13853eb RDX: 0000000000002330 RSI: 00005571aac13700 RDI: 0000000000000003 RBP: 0000000000002330 R08: 00005571aac10500 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe01faefb0 R13: 00007ffe01fad890 R14: 00007ffe01fad980 R15: 00005571aac0f0a0

The buggy address belongs to the page: page:000000001dff2e03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x147009 flags: 0x17ffffc0001000(reserved) raw: 0017ffffc0001000 ffffea00051c0248 ffffea00051c0248 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected

Memory state around the buggy address: ffff888147009400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888147009480: f1 f1 f1 f1 04 f2 f2 f2 f2 f2 f2 f2 00 00 00 00

ffff888147009500: 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 f2 ^ ffff888147009580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888147009600: 00 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2

for IPv4 packets, sch_fragment() uses a temporary struct dst_entry. Then, in the following call graph:

ip_do_fragment() ip_skb_dst_mtu() ip_dst_mtu_maybe_forward() ip_mtu_locked()

the pointer to struct dst_entry is used as pointer to struct rtable: this turns the access to struct members like rt_mtu_locked into an OOB read in the stack. Fix this changing the temporary variable used for IPv4 packets in sch_fragment(), similarly to what is done for IPv6 few lines below.

Record
CVE-2021-46954
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
CVE ListNo score

net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packets

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packets

when 'act_mirred' tries to fragment IPv4 packets that had been previously re-assembled using 'act_ct', splats like the following can be observed on kernels built with KASAN:

BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60 Read of size 1 at addr ffff888147009574 by task ping/947

CPU: 0 PID: 947 Comm: ping Not tainted 5.12.0-rc6+ #418 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 Call Trace: <IRQ> dump_stack+0x92/0xc1 print_address_description.constprop.7+0x1a/0x150 kasan_report.cold.13+0x7f/0x111 ip_do_fragment+0x1b03/0x1f60 sch_fragment+0x4bf/0xe40 tcf_mirred_act+0xc3d/0x11a0 [act_mirred] tcf_action_exec+0x104/0x3e0 fl_classify+0x49a/0x5e0 [cls_flower] tcf_classify_ingress+0x18a/0x820 __netif_receive_skb_core+0xae7/0x3340 __netif_receive_skb_one_core+0xb6/0x1b0 process_backlog+0x1ef/0x6c0 __napi_poll+0xaa/0x500 net_rx_action+0x702/0xac0 __do_softirq+0x1e4/0x97f do_softirq+0x71/0x90 </IRQ> __local_bh_enable_ip+0xdb/0xf0 ip_finish_output2+0x760/0x2120 ip_do_fragment+0x15a5/0x1f60 __ip_finish_output+0x4c2/0xea0 ip_output+0x1ca/0x4d0 ip_send_skb+0x37/0xa0 raw_sendmsg+0x1c4b/0x2d00 sock_sendmsg+0xdb/0x110 __sys_sendto+0x1d7/0x2b0 __x64_sys_sendto+0xdd/0x1b0 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f82e13853eb Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 75 42 2c 00 41 89 ca 8b 00 85 c0 75 14 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 75 c3 0f 1f 40 00 41 57 4d 89 c7 41 56 41 89 RSP: 002b:00007ffe01fad888 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00005571aac13700 RCX: 00007f82e13853eb RDX: 0000000000002330 RSI: 00005571aac13700 RDI: 0000000000000003 RBP: 0000000000002330 R08: 00005571aac10500 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe01faefb0 R13: 00007ffe01fad890 R14: 00007ffe01fad980 R15: 00005571aac0f0a0

The buggy address belongs to the page: page:000000001dff2e03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x147009 flags: 0x17ffffc0001000(reserved) raw: 0017ffffc0001000 ffffea00051c0248 ffffea00051c0248 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected

Memory state around the buggy address: ffff888147009400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888147009480: f1 f1 f1 f1 04 f2 f2 f2 f2 f2 f2 f2 00 00 00 00

ffff888147009500: 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 f2 ^ ffff888147009580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888147009600: 00 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2

for IPv4 packets, sch_fragment() uses a temporary struct dst_entry. Then, in the following call graph:

ip_do_fragment() ip_skb_dst_mtu() ip_dst_mtu_maybe_forward() ip_mtu_locked()

the pointer to struct dst_entry is used as pointer to struct rtable: this turns the access to struct members like rt_mtu_locked into an OOB read in the stack. Fix this changing the temporary variable used for IPv4 packets in sch_fragment(), similarly to what is done for IPv6 few lines below.

Record
CVE-2021-46954
Updated
2026-11-02
EUVDEUVD-2021-33602No score

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packets

when 'act_mirred' tries to fragment IPv4 packets that had been previously re-assembled using 'act_ct', splats like the following can be observed on kernels built with KASAN:

BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60 Read of size 1 at addr ffff888147009574 by task ping/947

CPU: 0 PID: 947 Comm: ping Not tainted 5.12.0-rc6+ #418 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 Call Trace: <IRQ> dump_stack+0x92/0xc1 print_address_description.constprop.7+0x1a/0x150 kasan_report.cold.13+0x7f/0x111 ip_do_fragment+0x1b03/0x1f60 sch_fragment+0x4bf/0xe40 tcf_mirred_act+0xc3d/0x11a0 [act_mirred] tcf_action_exec+0x104/0x3e0 fl_classify+0x49a/0x5e0 [cls_flower] tcf_classify_ingress+0x18a/0x820 __netif_receive_skb_core+0xae7/0x3340 __netif_receive_skb_one_core+0xb6/0x1b0 process_backlog+0x1ef/0x6c0 __napi_poll+0xaa/0x500 net_rx_action+0x702/0xac0 __do_softirq+0x1e4/0x97f do_softirq+0x71/0x90 </IRQ> __local_bh_enable_ip+0xdb/0xf0 ip_finish_output2+0x760/0x2120 ip_do_fragment+0x15a5/0x1f60 __ip_finish_output+0x4c2/0xea0 ip_output+0x1ca/0x4d0 ip_send_skb+0x37/0xa0 raw_sendmsg+0x1c4b/0x2d00 sock_sendmsg+0xdb/0x110 __sys_sendto+0x1d7/0x2b0 __x64_sys_sendto+0xdd/0x1b0 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f82e13853eb Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 75 42 2c 00 41 89 ca 8b 00 85 c0 75 14 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 75 c3 0f 1f 40 00 41 57 4d 89 c7 41 56 41 89 RSP: 002b:00007ffe01fad888 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00005571aac13700 RCX: 00007f82e13853eb RDX: 0000000000002330 RSI: 00005571aac13700 RDI: 0000000000000003 RBP: 0000000000002330 R08: 00005571aac10500 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe01faefb0 R13: 00007ffe01fad890 R14: 00007ffe01fad980 R15: 00005571aac0f0a0

The buggy address belongs to the page: page:000000001dff2e03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x147009 flags: 0x17ffffc0001000(reserved) raw: 0017ffffc0001000 ffffea00051c0248 ffffea00051c0248 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected

Memory state around the buggy address: ffff888147009400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888147009480: f1 f1 f1 f1 04 f2 f2 f2 f2 f2 f2 f2 00 00 00 00

ffff888147009500: 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 f2 ^ ffff888147009580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888147009600: 00 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2

for IPv4 packets, sch_fragment() uses a temporary struct dst_entry. Then, in the following call graph:

ip_do_fragment() ip_skb_dst_mtu() ip_dst_mtu_maybe_forward() ip_mtu_locked()

the pointer to struct dst_entry is used as pointer to struct rtable: this turns the access to struct members like rt_mtu_locked into an OOB read in the stack. Fix this changing the temporary variable used for IPv4 packets in sch_fragment(), similarly to what is done for IPv6 few lines below.

Record
EUVD-2021-33602
Updated
2026-11-02
GitHub AdvisoriesGHSA-6jf4-4jp9-4wmw7.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_frag: fix...

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packets

when 'act_mirred' tries to fragment IPv4 packets that had been previously re-assembled using 'act_ct', splats like the following can be observed on kernels built with KASAN:

BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60 Read of size 1 at addr ffff888147009574 by task ping/947

CPU: 0 PID: 947 Comm: ping Not tainted 5.12.0-rc6+ #418 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 Call Trace: <IRQ> dump_stack+0x92/0xc1 print_address_description.constprop.7+0x1a/0x150 kasan_report.cold.13+0x7f/0x111 ip_do_fragment+0x1b03/0x1f60 sch_fragment+0x4bf/0xe40 tcf_mirred_act+0xc3d/0x11a0 [act_mirred] tcf_action_exec+0x104/0x3e0 fl_classify+0x49a/0x5e0 [cls_flower] tcf_classify_ingress+0x18a/0x820 __netif_receive_skb_core+0xae7/0x3340 __netif_receive_skb_one_core+0xb6/0x1b0 process_backlog+0x1ef/0x6c0 __napi_poll+0xaa/0x500 net_rx_action+0x702/0xac0 __do_softirq+0x1e4/0x97f do_softirq+0x71/0x90 </IRQ> __local_bh_enable_ip+0xdb/0xf0 ip_finish_output2+0x760/0x2120 ip_do_fragment+0x15a5/0x1f60 __ip_finish_output+0x4c2/0xea0 ip_output+0x1ca/0x4d0 ip_send_skb+0x37/0xa0 raw_sendmsg+0x1c4b/0x2d00 sock_sendmsg+0xdb/0x110 __sys_sendto+0x1d7/0x2b0 __x64_sys_sendto+0xdd/0x1b0 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f82e13853eb Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 75 42 2c 00 41 89 ca 8b 00 85 c0 75 14 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 75 c3 0f 1f 40 00 41 57 4d 89 c7 41 56 41 89 RSP: 002b:00007ffe01fad888 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00005571aac13700 RCX: 00007f82e13853eb RDX: 0000000000002330 RSI: 00005571aac13700 RDI: 0000000000000003 RBP: 0000000000002330 R08: 00005571aac10500 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe01faefb0 R13: 00007ffe01fad890 R14: 00007ffe01fad980 R15: 00005571aac0f0a0

The buggy address belongs to the page: page:000000001dff2e03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x147009 flags: 0x17ffffc0001000(reserved) raw: 0017ffffc0001000 ffffea00051c0248 ffffea00051c0248 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected

Memory state around the buggy address: ffff888147009400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888147009480: f1 f1 f1 f1 04 f2 f2 f2 f2 f2 f2 f2 00 00 00 00

ffff888147009500: 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 f2 ^ ffff888147009580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888147009600: 00 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2

for IPv4 packets, sch_fragment() uses a temporary struct dst_entry. Then, in the following call graph:

ip_do_fragment() ip_skb_dst_mtu() ip_dst_mtu_maybe_forward() ip_mtu_locked()

the pointer to struct dst_entry is used as pointer to struct rtable: this turns the access to struct members like rt_mtu_locked into an OOB read in the stack. Fix this changing the temporary variable used for IPv4 packets in sch_fragment(), similarly to what is done for IPv6 few lines below.

Record
GHSA-6jf4-4jp9-4wmw
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVUBUNTU-CVE-2021-469547.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packets when 'act_mirred' tries to fragment IPv4 packets that had been previously re-assembled using 'act_ct', splats like the following can be observed on kernels built with KASAN: BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60 Read of size 1 at addr ffff888147009574 by task ping/947 CPU: 0 PID: 947 Comm: ping Not tainted 5.12.0-rc6+ #418 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 Call Trace: <IRQ> dump_stack+0x92/0xc1 print_address_description.constprop.7+0x1a/0x150 kasan_report.cold.13+0x7f/0x111 ip_do_fragment+0x1b03/0x1f60 sch_fragment+0x4bf/0xe40 tcf_mirred_act+0xc3d/0x11a0 [act_mirred] tcf_action_exec+0x104/0x3e0 fl_classify+0x49a/0x5e0 [cls_flower] tcf_classify_ingress+0x18a/0x820 __netif_receive_skb_core+0xae7/0x3340 __netif_receive_skb_one_core+0xb6/0x1b0 process_backlog+0x1ef/0x6c0 __napi_poll+0xaa/0x500 net_rx_action+0x702/0xac0 __do_softirq+0x1e4/0x97f do_softirq+0x71/0x90 </IRQ> __local_bh_enable_ip+0xdb/0xf0 ip_finish_output2+0x760/0x2120 ip_do_fragment+0x15a5/0x1f60 __ip_finish_output+0x4c2/0xea0 ip_output+0x1ca/0x4d0 ip_send_skb+0x37/0xa0 raw_sendmsg+0x1c4b/0x2d00 sock_sendmsg+0xdb/0x110 __sys_sendto+0x1d7/0x2b0 __x64_sys_sendto+0xdd/0x1b0 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f82e13853eb Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 75 42 2c 00 41 89 ca 8b 00 85 c0 75 14 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 75 c3 0f 1f 40 00 41 57 4d 89 c7 41 56 41 89 RSP: 002b:00007ffe01fad888 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00005571aac13700 RCX: 00007f82e13853eb RDX: 0000000000002330 RSI: 00005571aac13700 RDI: 0000000000000003 RBP: 0000000000002330 R08: 00005571aac10500 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe01faefb0 R13: 00007ffe01fad890 R14: 00007ffe01fad980 R15: 00005571aac0f0a0 The buggy address belongs to the page: page:000000001dff2e03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x147009 flags: 0x17ffffc0001000(reserved) raw: 0017ffffc0001000 ffffea00051c0248 ffffea00051c0248 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888147009400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888147009480: f1 f1 f1 f1 04 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 >ffff888147009500: 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 f2 ^ ffff888147009580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888147009600: 00 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 for IPv4 packets, sch_fragment() uses a temporary struct dst_entry. Then, in the following call graph: ip_do_fragment() ip_skb_dst_mtu() ip_dst_mtu_maybe_forward() ip_mtu_locked() the pointer to struct dst_entry is used as pointer to struct rtable: this turns the access to struct members like rt_mtu_locked into an OOB read in the stack. Fix this changing the temporary variable used for IPv4 packets in sch_fragment(), similarly to what is done for IPv6 few lines below.

Record
UBUNTU-CVE-2021-46954
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-10

Affected products

Affected packages

Affected packages
PackageAffectedFixed
linux-hwe-edge
Ubuntu:16.04:LTS
All versions, plus listed versions
4.8.0-28.30~16.04.14.8.0-30.32~16.04.14.8.0-32.34~16.04.14.8.0-34.36~16.04.14.10.0-14.16~16.04.1
Show 18 moreShow less
4.10.0-19.21~16.04.14.10.0-20.22~16.04.14.10.0-21.23~16.04.14.10.0-22.24~16.04.14.10.0-24.28~16.04.14.10.0-26.30~16.04.14.11.0-13.19~16.04.14.11.0-14.20~16.04.14.13.0-16.19~16.04.34.13.0-17.20~16.04.14.13.0-19.22~16.04.14.13.0-21.24~16.04.14.13.0-25.29~16.04.24.15.0-13.14~16.04.14.15.0-15.16~16.04.14.15.0-20.21~16.04.14.15.0-22.24~16.04.14.15.0-23.25~16.04.1
None known
linux-aws-5.0
Ubuntu:18.04:LTS
All versions, plus listed versions
5.0.0-1021.24~18.04.15.0.0-1022.25~18.04.15.0.0-1023.26~18.04.15.0.0-1024.27~18.04.15.0.0-1025.285.0.0-1027.30
None known
linux-aws-5.3
Ubuntu:18.04:LTS
All versions, plus listed versions
5.3.0-1016.17~18.04.15.3.0-1017.18~18.04.15.3.0-1019.21~18.04.15.3.0-1023.25~18.04.15.3.0-1028.30~18.04.1
Show 5 moreShow less
5.3.0-1030.32~18.04.15.3.0-1032.34~18.04.25.3.0-1033.355.3.0-1034.365.3.0-1035.37
None known
linux-azure
Ubuntu:18.04:LTS
All versions, plus listed versions
4.15.0-1002.24.15.0-1003.34.15.0-1004.44.15.0-1008.84.15.0-1009.9
Show 39 moreShow less
4.15.0-1012.124.15.0-1013.134.15.0-1014.144.15.0-1018.184.15.0-1019.194.15.0-1021.214.15.0-1022.234.15.0-1023.244.15.0-1025.264.15.0-1028.294.15.0-1030.314.15.0-1031.324.15.0-1032.334.15.0-1035.364.15.0-1036.384.15.0-1037.394.18.0-1011.11~18.04.14.18.0-1013.13~18.04.14.18.0-1014.14~18.04.14.18.0-1018.18~18.04.14.18.0-1019.19~18.04.14.18.0-1020.20~18.04.14.18.0-1023.24~18.04.14.18.0-1024.25~18.04.14.18.0-1025.27~18.04.15.0.0-1014.14~18.04.15.0.0-1016.17~18.04.15.0.0-1018.19~18.04.15.0.0-1020.21~18.04.15.0.0-1022.23~18.04.15.0.0-1023.24~18.04.15.0.0-1025.27~18.04.15.0.0-1027.29~18.04.15.0.0-1028.30~18.04.15.0.0-1029.31~18.04.15.0.0-1031.335.0.0-1032.345.0.0-1035.375.0.0-1036.38
None known
linux-azure-5.3
Ubuntu:18.04:LTS
All versions, plus listed versions
5.3.0-1007.8~18.04.15.3.0-1008.9~18.04.15.3.0-1009.10~18.04.15.3.0-1010.11~18.04.15.3.0-1012.13~18.04.1
Show 11 moreShow less
5.3.0-1013.14~18.04.15.3.0-1016.17~18.04.15.3.0-1018.19~18.04.15.3.0-1019.20~18.04.15.3.0-1020.21~18.04.15.3.0-1022.23~18.04.15.3.0-1028.29~18.04.15.3.0-1031.32~18.04.15.3.0-1032.33~18.04.15.3.0-1034.35~18.04.15.3.0-1035.36
None known
linux-azure-edge
Ubuntu:18.04:LTS
All versions, plus listed versions
4.18.0-1006.6~18.04.14.18.0-1007.7~18.04.14.18.0-1008.8~18.04.15.0.0-1012.12~18.04.2
None known
linux-gcp
Ubuntu:18.04:LTS
All versions, plus listed versions
4.15.0-1001.14.15.0-1003.34.15.0-1005.54.15.0-1006.64.15.0-1008.8
Show 33 moreShow less
4.15.0-1009.94.15.0-1010.104.15.0-1014.144.15.0-1015.154.15.0-1017.184.15.0-1018.194.15.0-1019.204.15.0-1021.224.15.0-1023.244.15.0-1024.254.15.0-1025.264.15.0-1026.274.15.0-1027.284.15.0-1028.294.15.0-1029.314.15.0-1030.324.15.0-1032.344.15.0-1033.354.15.0-1034.364.15.0-1036.384.15.0-1037.394.15.0-1040.424.15.0-1042.454.15.0-1044.705.0.0-1020.20~18.04.15.0.0-1021.21~18.04.15.0.0-1025.26~18.04.15.0.0-1026.27~18.04.15.0.0-1028.29~18.04.15.0.0-1029.30~18.04.15.0.0-1031.325.0.0-1033.345.0.0-1034.35
None known
linux-gcp-5.3
Ubuntu:18.04:LTS
All versions, plus listed versions
5.3.0-1008.9~18.04.15.3.0-1009.10~18.04.15.3.0-1010.11~18.04.15.3.0-1012.13~18.04.15.3.0-1014.15~18.04.1
Show 8 moreShow less
5.3.0-1016.17~18.04.15.3.0-1017.18~18.04.15.3.0-1018.19~18.04.15.3.0-1020.22~18.04.15.3.0-1026.28~18.04.15.3.0-1029.31~18.04.15.3.0-1030.32~18.04.15.3.0-1032.34~18.04.1
None known
linux-gke-4.15
Ubuntu:18.04:LTS
All versions, plus listed versions
4.15.0-1030.324.15.0-1032.344.15.0-1033.354.15.0-1034.364.15.0-1036.38
Show 28 moreShow less
4.15.0-1037.394.15.0-1040.424.15.0-1041.434.15.0-1042.444.15.0-1044.464.15.0-1045.484.15.0-1046.494.15.0-1048.514.15.0-1049.524.15.0-1050.534.15.0-1052.554.15.0-1055.584.15.0-1057.604.15.0-1058.614.15.0-1059.624.15.0-1063.664.15.0-1064.674.15.0-1066.694.15.0-1067.704.15.0-1069.724.15.0-1070.734.15.0-1072.764.15.0-1073.784.15.0-1074.794.15.0-1076.814.15.0-1077.824.15.0-1078.834.15.0-1079.84
None known
linux-gke-5.4
Ubuntu:18.04:LTS
All versions, plus listed versions
5.4.0-1025.25~18.04.15.4.0-1027.28~18.04.15.4.0-1029.31~18.04.15.4.0-1030.32~18.04.15.4.0-1032.34~18.04.1
Show 32 moreShow less
5.4.0-1033.35~18.04.15.4.0-1035.37~18.04.15.4.0-1036.38~18.04.15.4.0-1037.39~18.04.15.4.0-1039.41~18.04.15.4.0-1040.42~18.04.15.4.0-1042.44~18.04.15.4.0-1043.45~18.04.15.4.0-1044.46~18.04.15.4.0-1046.48~18.04.15.4.0-1049.52~18.04.15.4.0-1051.54~18.04.15.4.0-1052.55~18.04.15.4.0-1053.56~18.04.15.4.0-1054.57~18.04.15.4.0-1055.58~18.04.15.4.0-1056.59~18.04.15.4.0-1057.60~18.04.15.4.0-1059.62~18.04.15.4.0-1061.64~18.04.15.4.0-1062.65~18.04.15.4.0-1063.66~18.04.15.4.0-1065.68~18.04.15.4.0-1066.69~18.04.15.4.0-1067.70~18.04.15.4.0-1068.71~18.04.15.4.0-1071.76~18.04.35.4.0-1072.77~18.04.15.4.0-1074.79~18.04.15.4.0-1076.82~18.04.15.4.0-1078.84~18.04.15.4.0-1080.86~18.04.1
None known
Show 57 moreShow less
Affected packages
PackageAffectedFixed
linux-gkeop-5.4
Ubuntu:18.04:LTS
All versions, plus listed versions
5.4.0-1001.15.4.0-1003.35.4.0-1004.55.4.0-1005.65.4.0-1007.8~18.04.1
Show 32 moreShow less
5.4.0-1008.9~18.04.15.4.0-1009.10~18.04.15.4.0-1010.11~18.04.15.4.0-1011.12~18.04.25.4.0-1012.13~18.04.15.4.0-1013.14~18.04.15.4.0-1014.15~18.04.15.4.0-1015.16~18.04.15.4.0-1016.17~18.04.15.4.0-1018.19~18.04.15.4.0-1021.22~18.04.15.4.0-1022.23~18.04.15.4.0-1023.24~18.04.15.4.0-1024.25~18.04.15.4.0-1025.26~18.04.15.4.0-1026.27~18.04.15.4.0-1027.28~18.04.15.4.0-1029.30~18.04.25.4.0-1031.32~18.04.15.4.0-1032.33~18.04.15.4.0-1033.34~18.04.15.4.0-1034.35~18.04.15.4.0-1036.37~18.04.15.4.0-1037.38~18.04.15.4.0-1038.39~18.04.15.4.0-1039.40~18.04.15.4.0-1040.41~18.04.15.4.0-1043.44~18.04.15.4.0-1046.48~18.04.15.4.0-1048.51~18.04.15.4.0-1049.52~18.04.15.4.0-1051.54~18.04.1
None known
linux-hwe
Ubuntu:18.04:LTS
All versions, plus listed versions
4.18.0-13.14~18.04.14.18.0-14.15~18.04.14.18.0-15.16~18.04.14.18.0-16.17~18.04.14.18.0-17.18~18.04.1
Show 38 moreShow less
4.18.0-18.19~18.04.14.18.0-20.21~18.04.14.18.0-21.22~18.04.14.18.0-22.23~18.04.14.18.0-24.25~18.04.14.18.0-25.26~18.04.15.0.0-23.24~18.04.15.0.0-25.26~18.04.15.0.0-27.28~18.04.15.0.0-29.31~18.04.15.0.0-31.33~18.04.15.0.0-32.34~18.04.25.0.0-35.38~18.04.15.0.0-36.39~18.04.15.0.0-37.40~18.04.15.3.0-26.28~18.04.15.3.0-28.30~18.04.15.3.0-40.32~18.04.15.3.0-42.34~18.04.15.3.0-45.37~18.04.15.3.0-46.38~18.04.15.3.0-51.44~18.04.25.3.0-53.47~18.04.15.3.0-59.53~18.04.15.3.0-61.55~18.04.15.3.0-62.56~18.04.15.3.0-64.58~18.04.15.3.0-65.595.3.0-66.605.3.0-67.615.3.0-68.635.3.0-69.655.3.0-70.665.3.0-72.685.3.0-73.695.3.0-74.705.3.0-75.715.3.0-76.72
None known
linux-oem
Ubuntu:18.04:LTS
All versions, plus listed versions
4.15.0-1002.34.15.0-1004.54.15.0-1006.94.15.0-1008.114.15.0-1009.12
Show 45 moreShow less
4.15.0-1012.154.15.0-1013.164.15.0-1015.184.15.0-1017.204.15.0-1018.214.15.0-1021.244.15.0-1024.294.15.0-1026.314.15.0-1028.334.15.0-1030.354.15.0-1033.384.15.0-1034.394.15.0-1035.404.15.0-1036.414.15.0-1038.434.15.0-1039.444.15.0-1043.484.15.0-1045.504.15.0-1050.574.15.0-1056.654.15.0-1057.664.15.0-1059.684.15.0-1063.724.15.0-1064.734.15.0-1065.754.15.0-1066.764.15.0-1067.774.15.0-1069.794.15.0-1073.834.15.0-1076.864.15.0-1079.894.15.0-1080.904.15.0-1081.914.15.0-1087.974.15.0-1090.1004.15.0-1091.1014.15.0-1093.1034.15.0-1094.1044.15.0-1096.1064.15.0-1097.1074.15.0-1099.1094.15.0-1100.1104.15.0-1101.1124.15.0-1102.1134.15.0-1103.114
None known
linux-oracle-5.0
Ubuntu:18.04:LTS
All versions, plus listed versions
5.0.0-1007.12~18.04.15.0.0-1008.13~18.04.15.0.0-1009.14~18.04.15.0.0-1010.15~18.04.15.0.0-1011.165.0.0-1013.185.0.0-1014.19
None known
linux-oracle-5.3
Ubuntu:18.04:LTS
All versions, plus listed versions
5.3.0-1011.12~18.04.15.3.0-1013.14~18.04.15.3.0-1014.15~18.04.15.3.0-1016.18~18.04.15.3.0-1018.20~18.04.1
Show 4 moreShow less
5.3.0-1024.26~18.04.15.3.0-1027.29~18.04.15.3.0-1028.30~18.04.15.3.0-1030.32~18.04.1
None known
linux-aws-5.11
Ubuntu:20.04:LTS
All versions, plus listed versions
5.11.0-1009.9~20.04.25.11.0-1014.15~20.04.15.11.0-1016.17~20.04.15.11.0-1017.18~20.04.15.11.0-1019.20~20.04.1
Show 7 moreShow less
5.11.0-1020.21~20.04.25.11.0-1021.22~20.04.25.11.0-1022.23~20.04.15.11.0-1023.24~20.04.15.11.0-1025.27~20.04.15.11.0-1027.30~20.04.15.11.0-1028.31~20.04.1
None known
linux-aws-5.13
Ubuntu:20.04:LTS
All versions, plus listed versions
5.13.0-1008.9~20.04.25.13.0-1011.12~20.04.15.13.0-1012.13~20.04.15.13.0-1014.15~20.04.15.13.0-1017.19~20.04.1
Show 8 moreShow less
5.13.0-1019.21~20.04.15.13.0-1021.23~20.04.25.13.0-1022.24~20.04.15.13.0-1023.25~20.04.15.13.0-1025.27~20.04.15.13.0-1028.31~20.04.15.13.0-1029.32~20.04.15.13.0-1031.35~20.04.1
None known
linux-aws-5.8
Ubuntu:20.04:LTS
All versions, plus listed versions
5.8.0-1035.37~20.04.15.8.0-1038.40~20.04.15.8.0-1041.43~20.04.15.8.0-1042.44~20.04.1
None known
linux-azure-5.11
Ubuntu:20.04:LTS
All versions, plus listed versions
5.11.0-1007.7~20.04.25.11.0-1012.13~20.04.15.11.0-1013.14~20.04.15.11.0-1015.16~20.04.15.11.0-1017.18~20.04.1
Show 8 moreShow less
5.11.0-1019.20~20.04.15.11.0-1020.21~20.04.15.11.0-1021.22~20.04.15.11.0-1022.23~20.04.15.11.0-1023.24~20.04.15.11.0-1025.27~20.04.15.11.0-1027.30~20.04.15.11.0-1028.31~20.04.2
None known
linux-azure-5.13
Ubuntu:20.04:LTS
All versions, plus listed versions
5.13.0-1009.10~20.04.25.13.0-1012.14~20.04.15.13.0-1013.15~20.04.15.13.0-1014.16~20.04.15.13.0-1017.19~20.04.1
Show 7 moreShow less
5.13.0-1021.24~20.04.15.13.0-1022.26~20.04.15.13.0-1023.27~20.04.15.13.0-1025.29~20.04.15.13.0-1028.33~20.04.15.13.0-1029.34~20.04.15.13.0-1031.37~20.04.1
None known
linux-azure-5.8
Ubuntu:20.04:LTS
All versions, plus listed versions
5.8.0-1033.35~20.04.15.8.0-1036.38~20.04.15.8.0-1039.42~20.04.15.8.0-1040.43~20.04.15.8.0-1041.44~20.04.15.8.0-1042.45~20.04.15.8.0-1043.46~20.04.1
None known
linux-azure-fde
Ubuntu:20.04:LTS
All versions, plus listed versions
5.4.0-1063.66+cvm2.25.4.0-1063.66+cvm3.25.4.0-1064.67+cvm1.15.4.0-1065.68+cvm2.15.4.0-1067.70+cvm1.1
Show 21 moreShow less
5.4.0-1068.71+cvm1.15.4.0-1069.72+cvm1.15.4.0-1070.73+cvm1.15.4.0-1072.75+cvm1.15.4.0-1073.76+cvm1.15.4.0-1074.77+cvm1.15.4.0-1076.79+cvm1.15.4.0-1078.81+cvm1.15.4.0-1080.83+cvm1.15.4.0-1083.87+cvm1.15.4.0-1085.90+cvm1.15.4.0-1085.90+cvm2.15.4.0-1086.91+cvm1.15.4.0-1089.94+cvm1.25.4.0-1090.95+cvm1.15.4.0-1091.96+cvm1.15.4.0-1092.97+cvm1.15.4.0-1095.101+cvm1.15.4.0-1098.104+cvm1.15.4.0-1100.106+cvm1.15.4.0-1103.109+cvm1.1
None known
linux-bluefield
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
5.4.0-1007.105.4.0-1011.145.4.0-1012.155.4.0-1013.165.4.0-1016.19
Show 45 moreShow less
5.4.0-1019.225.4.0-1020.235.4.0-1021.245.4.0-1022.255.4.0-1023.265.4.0-1025.285.4.0-1026.295.4.0-1028.315.4.0-1030.335.4.0-1032.355.4.0-1035.385.4.0-1036.395.4.0-1040.445.4.0-1042.475.4.0-1044.495.4.0-1045.505.4.0-1046.515.4.0-1047.525.4.0-1049.555.4.0-1050.565.4.0-1054.605.4.0-1058.645.4.0-1059.655.4.0-1060.665.4.0-1062.685.4.0-1064.705.4.0-1065.715.4.0-1066.725.4.0-1068.745.4.0-1070.765.4.0-1071.775.4.0-1072.785.4.0-1073.795.4.0-1074.805.4.0-1075.815.4.0-1076.825.4.0-1077.835.4.0-1078.845.4.0-1079.855.4.0-1080.875.4.0-1081.885.4.0-1082.895.4.0-1083.905.4.0-1084.915.4.0-1085.92
None known
linux-gcp-5.11
Ubuntu:20.04:LTS
All versions, plus listed versions
5.11.0-1009.10~20.04.15.11.0-1014.16~20.04.15.11.0-1017.19~20.04.15.11.0-1018.20~20.04.25.11.0-1020.22~20.04.1
Show 7 moreShow less
5.11.0-1021.23~20.04.15.11.0-1022.24~20.04.15.11.0-1023.25~20.04.15.11.0-1024.26~20.04.15.11.0-1026.29~20.04.15.11.0-1028.32~20.04.15.11.0-1029.33~20.04.3
None known
linux-gcp-5.13
Ubuntu:20.04:LTS
All versions, plus listed versions
5.13.0-1008.9~20.04.35.13.0-1012.15~20.04.15.13.0-1013.16~20.04.15.13.0-1015.18~20.04.15.13.0-1019.23~20.04.1
Show 8 moreShow less
5.13.0-1021.25~20.04.15.13.0-1023.28~20.04.15.13.0-1024.29~20.04.15.13.0-1025.30~20.04.15.13.0-1027.32~20.04.15.13.0-1030.36~20.04.15.13.0-1031.37~20.04.15.13.0-1033.40~20.04.1
None known
linux-gcp-5.8
Ubuntu:20.04:LTS
All versions, plus listed versions
5.8.0-1032.34~20.04.15.8.0-1035.37~20.04.15.8.0-1038.40~20.04.15.8.0-1039.41
None known
linux-gke
Ubuntu:20.04:LTS
All versions, plus listed versions
5.4.0-1033.355.4.0-1035.375.4.0-1036.385.4.0-1037.395.4.0-1039.41
Show 45 moreShow less
5.4.0-1041.435.4.0-1042.445.4.0-1043.455.4.0-1044.465.4.0-1046.485.4.0-1049.525.4.0-1051.545.4.0-1052.555.4.0-1053.565.4.0-1054.575.4.0-1055.585.4.0-1056.595.4.0-1057.605.4.0-1059.625.4.0-1061.645.4.0-1062.655.4.0-1063.665.4.0-1065.685.4.0-1066.695.4.0-1067.705.4.0-1068.715.4.0-1071.765.4.0-1072.775.4.0-1074.795.4.0-1076.825.4.0-1078.845.4.0-1080.865.4.0-1081.875.4.0-1083.895.4.0-1084.905.4.0-1086.935.4.0-1087.945.4.0-1090.975.4.0-1091.985.4.0-1094.1015.4.0-1095.1025.4.0-1096.1035.4.0-1097.1045.4.0-1098.1055.4.0-1099.1065.4.0-1100.1075.4.0-1101.1085.4.0-1102.1095.4.0-1103.1105.4.0-1104.111
None known
linux-gke-5.15
Ubuntu:20.04:LTS
All versions, plus listed versions
5.15.0-1011.14~20.04.15.15.0-1014.17~20.04.15.15.0-1015.18~20.04.15.15.0-1016.19~20.04.15.15.0-1019.23~20.04.1
Show 13 moreShow less
5.15.0-1020.25~20.04.15.15.0-1023.28~20.04.25.15.0-1027.32~20.04.15.15.0-1028.33~20.04.15.15.0-1029.34~20.04.15.15.0-1031.36~20.04.15.15.0-1032.37~20.04.15.15.0-1033.38~20.04.15.15.0-1034.39~20.04.15.15.0-1036.41~20.04.15.15.0-1037.42~20.04.15.15.0-1038.43~20.04.15.15.0-1039.44~20.04.1
None known
linux-hwe-5.11
Ubuntu:20.04:LTS
All versions, plus listed versions
5.11.0-22.23~20.04.15.11.0-25.27~20.04.15.11.0-27.29~20.04.15.11.0-34.36~20.04.15.11.0-36.40~20.04.1
Show 7 moreShow less
5.11.0-37.41~20.04.25.11.0-38.42~20.04.15.11.0-40.44~20.04.25.11.0-41.45~20.04.15.11.0-43.47~20.04.25.11.0-44.48~20.04.25.11.0-46.51~20.04.1
None known
linux-hwe-5.13
Ubuntu:20.04:LTS
All versions, plus listed versions
5.13.0-21.21~20.04.15.13.0-22.22~20.04.15.13.0-23.23~20.04.25.13.0-25.26~20.04.15.13.0-27.29~20.04.1
Show 11 moreShow less
5.13.0-28.31~20.04.15.13.0-30.33~20.04.15.13.0-35.40~20.04.15.13.0-37.42~20.04.15.13.0-39.44~20.04.15.13.0-40.45~20.04.15.13.0-41.46~20.04.15.13.0-44.49~20.04.15.13.0-48.54~20.04.15.13.0-51.58~20.04.15.13.0-52.59~20.04.1
None known
linux-hwe-5.8
Ubuntu:20.04:LTS
All versions, plus listed versions
5.8.0-23.24~20.04.15.8.0-25.26~20.04.15.8.0-28.30~20.04.15.8.0-29.31~20.04.15.8.0-31.33~20.04.1
Show 16 moreShow less
5.8.0-33.36~20.04.15.8.0-34.37~20.04.25.8.0-36.40~20.04.15.8.0-38.43~20.04.15.8.0-40.45~20.04.15.8.0-41.46~20.04.15.8.0-43.49~20.04.15.8.0-44.50~20.04.15.8.0-45.51~20.04.15.8.0-48.54~20.04.15.8.0-49.55~20.04.15.8.0-50.56~20.04.15.8.0-53.60~20.04.15.8.0-55.62~20.04.15.8.0-59.66~20.04.15.8.0-63.71~20.04.1
None known
linux-intel-5.13
Ubuntu:20.04:LTS
All versions, plus listed versions
5.13.0-1007.75.13.0-1008.85.13.0-1009.95.13.0-1010.105.13.0-1011.115.13.0-1014.155.13.0-1017.19
None known
linux-oem-5.10
Ubuntu:20.04:LTS
All versions, plus listed versions
5.10.0-1008.95.10.0-1011.125.10.0-1013.145.10.0-1014.155.10.0-1016.17
Show 21 moreShow less
5.10.0-1017.185.10.0-1019.205.10.0-1021.225.10.0-1022.235.10.0-1023.245.10.0-1025.265.10.0-1026.275.10.0-1029.305.10.0-1032.335.10.0-1033.345.10.0-1034.355.10.0-1038.405.10.0-1044.465.10.0-1045.475.10.0-1049.515.10.0-1050.525.10.0-1051.535.10.0-1052.545.10.0-1053.555.10.0-1055.585.10.0-1057.61
None known
linux-oem-5.13
Ubuntu:20.04:LTS
All versions, plus listed versions
5.13.0-1009.105.13.0-1010.115.13.0-1012.165.13.0-1014.185.13.0-1017.21
Show 7 moreShow less
5.13.0-1019.235.13.0-1020.245.13.0-1021.255.13.0-1022.265.13.0-1026.325.13.0-1028.355.13.0-1029.36
None known
linux-oem-5.14
Ubuntu:20.04:LTS
All versions, plus listed versions
5.14.0-1004.45.14.0-1005.55.14.0-1007.75.14.0-1008.85.14.0-1010.10
Show 30 moreShow less
5.14.0-1011.115.14.0-1013.135.14.0-1018.195.14.0-1020.225.14.0-1022.245.14.0-1024.265.14.0-1027.305.14.0-1029.325.14.0-1031.345.14.0-1032.355.14.0-1033.365.14.0-1034.375.14.0-1036.405.14.0-1038.425.14.0-1042.475.14.0-1044.495.14.0-1045.515.14.0-1046.535.14.0-1047.545.14.0-1048.555.14.0-1049.565.14.0-1050.575.14.0-1051.585.14.0-1052.595.14.0-1054.615.14.0-1055.625.14.0-1056.635.14.0-1057.645.14.0-1058.665.14.0-1059.67
None known
linux-oem-5.6
Ubuntu:20.04:LTS
All versions, plus listed versions
5.6.0-1007.75.6.0-1008.85.6.0-1010.105.6.0-1011.115.6.0-1013.13
Show 24 moreShow less
5.6.0-1017.175.6.0-1018.185.6.0-1020.205.6.0-1021.215.6.0-1023.235.6.0-1026.265.6.0-1027.275.6.0-1028.285.6.0-1031.325.6.0-1032.335.6.0-1033.355.6.0-1034.365.6.0-1035.375.6.0-1036.395.6.0-1039.435.6.0-1042.465.6.0-1047.515.6.0-1048.525.6.0-1050.545.6.0-1052.565.6.0-1053.575.6.0-1054.585.6.0-1055.595.6.0-1056.60
None known
linux-oracle-5.11
Ubuntu:20.04:LTS
All versions, plus listed versions
5.11.0-1008.8~20.04.15.11.0-1013.14~20.04.15.11.0-1016.17~20.04.15.11.0-1017.18~20.04.15.11.0-1019.20~20.04.1
Show 7 moreShow less
5.11.0-1020.21~20.04.15.11.0-1021.22~20.04.15.11.0-1022.23~20.04.15.11.0-1023.24~20.04.15.11.0-1025.27~20.04.15.11.0-1027.30~20.04.15.11.0-1028.31~20.04.1
None known
linux-oracle-5.13
Ubuntu:20.04:LTS
All versions, plus listed versions
5.13.0-1011.13~20.04.25.13.0-1015.19~20.04.15.13.0-1016.20~20.04.15.13.0-1018.22~20.04.15.13.0-1021.26~20.04.1
Show 7 moreShow less
5.13.0-1025.30~20.04.15.13.0-1027.32~20.04.15.13.0-1028.33~20.04.15.13.0-1030.35~20.04.15.13.0-1033.39~20.04.15.13.0-1034.40~20.04.15.13.0-1036.43~20.04.1
None known
linux-oracle-5.8
Ubuntu:20.04:LTS
All versions, plus listed versions
5.8.0-1031.32~20.04.25.8.0-1033.34~20.04.15.8.0-1034.35~20.04.25.8.0-1037.38~20.04.15.8.0-1038.39~20.04.1
None known
linux-raspi2
Ubuntu:20.04:LTS
All versions, plus listed versions
5.3.0-1007.85.3.0-1014.165.3.0-1015.175.3.0-1017.195.4.0-1004.45.4.0-1006.6
None known
linux-riscv
Ubuntu:20.04:LTS
All versions, plus listed versions
5.4.0-24.285.4.0-26.305.4.0-27.315.4.0-28.325.4.0-30.34
Show 7 moreShow less
5.4.0-31.355.4.0-33.375.4.0-34.385.4.0-36.415.4.0-37.425.4.0-39.445.4.0-40.45
None known
linux-riscv-5.11
Ubuntu:20.04:LTS
All versions, plus listed versions
5.11.0-1015.16~20.04.15.11.0-1017.18~20.04.15.11.0-1018.19~20.04.25.11.0-1020.21~20.04.15.11.0-1021.22~20.04.1
Show 8 moreShow less
5.11.0-1022.23~20.04.15.11.0-1023.24~20.04.15.11.0-1024.25~20.04.15.11.0-1026.28~20.04.15.11.0-1028.31~20.04.15.11.0-1029.32~20.04.15.11.0-1030.345.11.0-1031.35
None known
linux-riscv-5.8
Ubuntu:20.04:LTS
All versions, plus listed versions
5.8.0-14.16~20.04.15.8.0-14.16~20.04.35.8.0-16.18~20.04.15.8.0-17.19~20.04.15.8.0-18.20~20.04.1
Show 5 moreShow less
5.8.0-20.22~20.04.15.8.0-22.24~20.04.15.8.0-25.27~20.04.15.8.0-26.28~20.04.15.8.0-29.31~20.04.1
None known
linux-allwinner-5.19
Ubuntu:22.04:LTS
All versions, plus listed versions
5.19.0-1007.7~22.04.15.19.0-1009.9~22.04.15.19.0-1010.10~22.04.15.19.0-1011.11~22.04.15.19.0-1012.12~22.04.15.19.0-1013.13~22.04.15.19.0-1014.14~22.04.15.19.0-1015.15~22.04.1
None known
linux-aws-5.19
Ubuntu:22.04:LTS
All versions, plus listed versions
5.19.0-1019.20~22.04.15.19.0-1020.21~22.04.15.19.0-1022.23~22.04.15.19.0-1023.24~22.04.15.19.0-1024.25~22.04.1
Show 5 moreShow less
5.19.0-1025.26~22.04.15.19.0-1026.27~22.04.15.19.0-1027.28~22.04.15.19.0-1028.29~22.04.15.19.0-1029.30~22.04.1
None known
linux-aws-6.2
Ubuntu:22.04:LTS
All versions, plus listed versions
6.2.0-1005.5~22.04.16.2.0-1006.6~22.04.16.2.0-1007.7~22.04.16.2.0-1008.8~22.04.16.2.0-1009.9~22.04.3
Show 9 moreShow less
6.2.0-1010.10~22.04.16.2.0-1011.11~22.04.16.2.0-1012.12~22.04.16.2.0-1013.13~22.04.16.2.0-1014.14~22.04.16.2.0-1015.15~22.04.16.2.0-1016.16~22.04.16.2.0-1017.17~22.04.16.2.0-1018.18~22.04.1
None known
linux-azure-5.19
Ubuntu:22.04:LTS
All versions, plus listed versions
5.19.0-1020.21~22.04.15.19.0-1021.22~22.04.15.19.0-1022.23~22.04.15.19.0-1023.24~22.04.15.19.0-1025.28~22.04.15.19.0-1026.29~22.04.15.19.0-1027.30~22.04.2
None known
linux-azure-6.2
Ubuntu:22.04:LTS
All versions, plus listed versions
6.2.0-1005.5~22.04.16.2.0-1006.6~22.04.16.2.0-1007.7~22.04.16.2.0-1008.8~22.04.16.2.0-1009.9~22.04.3
Show 8 moreShow less
6.2.0-1011.11~22.04.16.2.0-1012.12~22.04.16.2.0-1014.14~22.04.16.2.0-1015.15~22.04.16.2.0-1016.16~22.04.16.2.0-1017.17~22.04.16.2.0-1018.18~22.04.16.2.0-1019.19~22.04.1
None known
linux-azure-fde-5.19
Ubuntu:22.04:LTS
All versions, plus listed versions
5.19.0-1025.28~22.04.1.15.19.0-1026.29~22.04.1.15.19.0-1027.30~22.04.2.1
None known
linux-azure-fde-6.2
Ubuntu:22.04:LTS
All versions, plus listed versions
6.2.0-1008.8~22.04.1.16.2.0-1009.9~22.04.3.16.2.0-1011.11~22.04.1.16.2.0-1012.12~22.04.1.16.2.0-1014.14~22.04.1.1
Show 5 moreShow less
6.2.0-1015.15~22.04.1.16.2.0-1016.16~22.04.1.16.2.0-1017.17~22.04.1.16.2.0-1018.18~22.04.1.16.2.0-1019.19~22.04.1.1
None known
linux-gcp-5.19
Ubuntu:22.04:LTS
All versions, plus listed versions
5.19.0-1020.22~22.04.25.19.0-1021.23~22.04.15.19.0-1022.24~22.04.15.19.0-1024.26~22.04.15.19.0-1025.27~22.04.15.19.0-1026.28~22.04.15.19.0-1027.29~22.04.15.19.0-1030.32~22.04.1
None known
linux-gcp-6.2
Ubuntu:22.04:LTS
All versions, plus listed versions
6.2.0-1009.9~22.04.36.2.0-1010.10~22.04.16.2.0-1011.11~22.04.16.2.0-1011.11~22.04.36.2.0-1012.12~22.04.1
Show 7 moreShow less
6.2.0-1013.13~22.04.16.2.0-1014.14~22.04.16.2.0-1016.18~22.04.16.2.0-1017.19~22.04.16.2.0-1018.20~22.04.16.2.0-1019.21~22.04.16.2.0-1021.23~22.04.1
None known
linux-hwe-5.19
Ubuntu:22.04:LTS
All versions, plus listed versions
5.19.0-28.29~22.04.15.19.0-32.33~22.04.15.19.0-35.36~22.04.15.19.0-38.39~22.04.15.19.0-40.41~22.04.1
Show 6 moreShow less
5.19.0-41.42~22.04.15.19.0-42.43~22.04.15.19.0-43.44~22.04.15.19.0-45.46~22.04.15.19.0-46.47~22.04.15.19.0-50.50
None known
linux-hwe-6.2
Ubuntu:22.04:LTS
All versions, plus listed versions
6.2.0-25.25~22.04.26.2.0-26.26~22.04.16.2.0-31.31~22.04.16.2.0-32.32~22.04.16.2.0-33.33~22.04.1
Show 5 moreShow less
6.2.0-34.34~22.04.16.2.0-35.35~22.04.16.2.0-36.37~22.04.16.2.0-37.38~22.04.16.2.0-39.40~22.04.1
None known
linux-intel-iot-realtime
Ubuntu:22.04:LTS
All versions, plus listed versions
5.15.0-1073.75
None known
linux-lowlatency-hwe-5.19
Ubuntu:22.04:LTS
All versions, plus listed versions
5.19.0-1017.18~22.04.15.19.0-1018.19~22.04.15.19.0-1021.22~22.04.15.19.0-1022.23~22.04.15.19.0-1023.24~22.04.1
Show 5 moreShow less
5.19.0-1024.25~22.04.15.19.0-1025.26~22.04.15.19.0-1027.28~22.04.15.19.0-1028.29~22.04.15.19.0-1030.30
None known
linux-lowlatency-hwe-6.2
Ubuntu:22.04:LTS
All versions, plus listed versions
6.2.0-1008.8~22.04.16.2.0-1009.9~22.04.16.2.0-1011.11~22.04.16.2.0-1012.12~22.04.16.2.0-1013.13~22.04.1
Show 5 moreShow less
6.2.0-1014.14~22.04.16.2.0-1015.15~22.04.16.2.0-1016.16~22.04.16.2.0-1017.17~22.04.16.2.0-1018.18~22.04.1
None known
linux-nvidia-6.2
Ubuntu:22.04:LTS
All versions, plus listed versions
6.2.0-1003.3~22.04.16.2.0-1009.96.2.0-1010.106.2.0-1011.116.2.0-1012.126.2.0-1013.136.2.0-1015.15
None known
linux-oem-5.17
Ubuntu:22.04:LTS
All versions, plus listed versions
5.17.0-1003.35.17.0-1004.45.17.0-1006.65.17.0-1011.125.17.0-1012.13
Show 21 moreShow less
5.17.0-1013.145.17.0-1014.155.17.0-1015.165.17.0-1016.175.17.0-1017.185.17.0-1018.195.17.0-1019.205.17.0-1020.215.17.0-1021.225.17.0-1024.255.17.0-1025.265.17.0-1026.275.17.0-1027.285.17.0-1028.295.17.0-1029.305.17.0-1030.315.17.0-1031.325.17.0-1032.335.17.0-1033.345.17.0-1034.355.17.0-1035.36
None known
linux-oem-6.0
Ubuntu:22.04:LTS
All versions, plus listed versions
6.0.0-1006.66.0.0-1007.76.0.0-1008.86.0.0-1009.96.0.0-1010.10
Show 11 moreShow less
6.0.0-1011.116.0.0-1012.126.0.0-1013.136.0.0-1014.146.0.0-1015.156.0.0-1016.166.0.0-1017.176.0.0-1018.186.0.0-1019.196.0.0-1020.206.0.0-1021.21
None known
linux-oem-6.1
Ubuntu:22.04:LTS
All versions, plus listed versions
6.1.0-1004.46.1.0-1006.66.1.0-1007.76.1.0-1008.86.1.0-1009.9
Show 22 moreShow less
6.1.0-1010.106.1.0-1012.126.1.0-1013.136.1.0-1014.146.1.0-1015.156.1.0-1016.166.1.0-1017.176.1.0-1019.196.1.0-1020.206.1.0-1021.216.1.0-1022.226.1.0-1023.236.1.0-1024.246.1.0-1025.256.1.0-1026.266.1.0-1027.276.1.0-1028.286.1.0-1029.296.1.0-1033.336.1.0-1034.346.1.0-1035.356.1.0-1036.36
None known
linux-realtime
Ubuntu:22.04:LTS
All versions, plus listed versions
5.15.0-1032.35
None known
linux-riscv
Ubuntu:22.04:LTS
All versions, plus listed versions
5.13.0-1004.45.13.0-1006.6+22.04.15.13.0-1007.7+22.04.15.13.0-1010.11+22.04.15.15.0-1004.4
Show 18 moreShow less
5.15.0-1005.55.15.0-1006.65.15.0-1007.75.15.0-1008.85.15.0-1011.125.15.0-1012.135.15.0-1014.165.15.0-1015.175.15.0-1016.185.15.0-1017.195.15.0-1018.215.15.0-1019.225.15.0-1020.235.15.0-1022.265.15.0-1023.275.15.0-1026.305.15.0-1027.315.15.0-1028.32
None known
linux-riscv-5.19
Ubuntu:22.04:LTS
All versions, plus listed versions
5.19.0-1012.13~22.04.15.19.0-1015.16~22.04.15.19.0-1016.17~22.04.15.19.0-1017.18~22.04.15.19.0-1018.19~22.04.15.19.0-1019.21~22.04.15.19.0-1020.22~22.04.15.19.0-1021.23~22.04.1
None known
linux-starfive-5.19
Ubuntu:22.04:LTS
All versions, plus listed versions
5.19.0-1014.16~22.04.15.19.0-1015.17~22.04.15.19.0-1016.18~22.04.15.19.0-1017.19~22.04.15.19.0-1018.20~22.04.15.19.0-1019.21~22.04.15.19.0-1020.22~22.04.1
None known
linux-starfive-6.2
Ubuntu:22.04:LTS
All versions, plus listed versions
6.2.0-1006.7~22.04.16.2.0-1007.8~22.04.16.2.0-1009.10~22.04.1
None known
linux-raspi-realtime
Ubuntu:24.04:LTS
All versions, plus listed versions
6.8.0-2019.20
None known

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-46954 is a high vulnerability (CVSS 7.1) in Linux, published February 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. No source names a fixed version.

References

This page doesn't list everything

Left out here: 35 versions. The JSON record has them.

MoveEnter Open