What’s Vulnerable › Vulnerabilities

CVE-2021-47306: net: fddi: fix UAF in fza_probe

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-21 · updated 2026-06-17
• Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: net: fddi: fix UAF in fza_probe fp is netdev private data and it cannot be used after free_netdev() call. Using fp after free_netdev() can cause UAF bug. Fix it by moving free_netdev() after error message. TURBOchannel adapter")

Affected products

• Linux kernel: from 4.20 before 5.4.135; from 5.5 before 5.10.53; from 5.11 before 5.13.5; 5.14-rc1 — fixed in 5.10.53, 5.13.5, 5.4.135

How to fix

Upgrade to a fixed version: Linux kernel 5.10.53, 5.13.5, 5.4.135. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/04b06716838bfc26742dbed3ae1d3697fe5317ee
• https://git.kernel.org/stable/c/bdfbb51f7a437ae8ea91317a5c133ec13adf3c47
• https://git.kernel.org/stable/c/deb7178eb940e2c5caca1b1db084a69b2e59b4c9
• https://git.kernel.org/stable/c/f33605908a9b6063525e9f68e62d739948c5fccf
• https://git.kernel.org/stable/c/04b06716838bfc26742dbed3ae1d3697fe5317ee
• https://git.kernel.org/stable/c/bdfbb51f7a437ae8ea91317a5c133ec13adf3c47
• https://git.kernel.org/stable/c/deb7178eb940e2c5caca1b1db084a69b2e59b4c9
• https://git.kernel.org/stable/c/f33605908a9b6063525e9f68e62d739948c5fccf

Get alerted when CVE-2021-47306 or the next vulnerability affects your stack