CVE-2021-47248: udp: fix race between close() and udp_abort()

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-21 · updated 2026-08-04
Weakness: CWE-362

Description

In the Linux kernel, the following vulnerability has been resolved: udp: fix race between close() and udp_abort() Kaustubh reported and diagnosed a panic in udp_lib_lookup(). The root cause is udp_abort() racing with close(). Both racing functions acquire the socket lock, but udp{v6}_destroy_sock() release it before performing destructive actions. We can't easily extend the socket lock scope to avoid the race, instead use the SOCK_DEAD flag to prevent udp_abort from doing any action when the critical race happens. Diagnosed-and-tested-by: Kaustubh Pandey <kapandey@codeaurora.org>

Affected products

Linux kernel: from 4.9 before 4.9.274; from 4.10 before 4.14.238; from 4.15 before 4.19.196; from 4.20 before 5.4.128; from 5.5 before 5.10.46; from 5.11 before 5.12.13 — fixed in 4.14.238, 4.19.196, 4.9.274, 5.10.46, 5.12.13, 5.4.128

How to fix

Upgrade to a fixed version: Linux kernel 4.14.238, 4.19.196, 4.9.274, 5.10.46. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-47248 or the next vulnerability affects your stack