CVE-2021-46998

ethernet:enic: Fix a use after free bug in enic_hard_start_xmit

State: Published
Severity: 7.8 High
Published: Feb 28, 2024
Updated: Aug 5, 2026
Reserved: Feb 27, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ethernet:enic: Fix a use after free bug in enic_hard_start_xmit

In enic_hard_start_xmit, it calls enic_queue_wq_skb(). Inside enic_queue_wq_skb, if some error happens, the skb will be freed by dev_kfree_skb(skb). But the freed skb is still used in skb_tx_timestamp(skb).

My patch makes enic_queue_wq_skb() return error and goto spin_unlock() incase of error. The solution is provided by Govind. See https://lkml.org/lkml/2021/4/30/961.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3 to before 25a87b1f566b5eb2af2857a928f0e2310d900976Affected fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3 to before f7f6f07774091a6ddd98500b85386c3c6afb30d3Affected fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3 to before 7afdd6aba95c8a526038e7abe283eeac3e4320f1Affected fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3 to before 6892396ebf04ea2c021d80e10f4075e014cd7cc3Affected fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3 to before d90529392aaf498dafa95d212295d64b2cea4e24Affected fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3 to before 643001b47adc844ae33510c4bb93c236667008a3Affected
LinuxLinux	4.16Affected before 4.16Not affected 4.19.191 through 4.19.Not affected 5.4.120 through 5.4.Not affected 5.10.38 through 5.10.Not affected 5.11.22 through 5.11.Not affected 5.12.5 through 5.12.*Not affected 5.13 and laterNot affected

Product

Versions

LinuxLinux

fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3 to before 25a87b1f566b5eb2af2857a928f0e2310d900976Affected
fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3 to before f7f6f07774091a6ddd98500b85386c3c6afb30d3Affected
fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3 to before 7afdd6aba95c8a526038e7abe283eeac3e4320f1Affected
fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3 to before 6892396ebf04ea2c021d80e10f4075e014cd7cc3Affected
fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3 to before d90529392aaf498dafa95d212295d64b2cea4e24Affected
fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3 to before 643001b47adc844ae33510c4bb93c236667008a3Affected

LinuxLinux

4.16Affected
before 4.16Not affected
4.19.191 through 4.19.*Not affected
5.4.120 through 5.4.*Not affected
5.10.38 through 5.10.*Not affected
5.11.22 through 5.11.*Not affected
5.12.5 through 5.12.*Not affected
5.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.