CVE-2021-47013

net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send

State: Published
Severity: 9.8 Critical
Published: Feb 28, 2024
Updated: Aug 5, 2026
Reserved: Feb 27, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send

In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..). If some error happens in emac_tx_fill_tpd(), the skb will be freed via dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd(). But the freed skb is still used via skb->len by netdev_sent_queue(,skb->len).

As i observed that emac_tx_fill_tpd() haven't modified the value of skb->len, thus my patch assigns skb->len to 'len' before the possible free and use 'len' instead of skb->len later.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b9b17debc69d27cd55e21ee51a5ba7fc50a426cf to before c7f75d11fe72913d2619f97b2334b083cd7bb955Affected b9b17debc69d27cd55e21ee51a5ba7fc50a426cf to before dc1b438a35773d030be0ee80d9c635c3e558a322Affected b9b17debc69d27cd55e21ee51a5ba7fc50a426cf to before 16d8c44be52e3650917736d45f5904384a9da834Affected b9b17debc69d27cd55e21ee51a5ba7fc50a426cf to before 55fcdd1258faaecca74b91b88cc0921f9edd775dAffected b9b17debc69d27cd55e21ee51a5ba7fc50a426cf to before 9dc373f74097edd0e35f3393d6248eda8d1ba99dAffected b9b17debc69d27cd55e21ee51a5ba7fc50a426cf to before 8c06f34785068b87e2b560534c77c163d6c6dca7Affected b9b17debc69d27cd55e21ee51a5ba7fc50a426cf to before e407495ba6788a67d1bd41714158c079e340879bAffected b9b17debc69d27cd55e21ee51a5ba7fc50a426cf to before 6d72e7c767acbbdd44ebc7d89c6690b405b32b57Affected
LinuxLinux	4.9Affected before 4.9Not affected 4.9.269 through 4.9.Not affected 4.14.233 through 4.14.Not affected 4.19.191 through 4.19.Not affected 5.4.119 through 5.4.Not affected 5.10.37 through 5.10.Not affected 5.11.21 through 5.11.Not affected 5.12.4 through 5.12.*Not affected 5.13 and laterNot affected

Product

Versions

LinuxLinux

b9b17debc69d27cd55e21ee51a5ba7fc50a426cf to before c7f75d11fe72913d2619f97b2334b083cd7bb955Affected
b9b17debc69d27cd55e21ee51a5ba7fc50a426cf to before dc1b438a35773d030be0ee80d9c635c3e558a322Affected
b9b17debc69d27cd55e21ee51a5ba7fc50a426cf to before 16d8c44be52e3650917736d45f5904384a9da834Affected
b9b17debc69d27cd55e21ee51a5ba7fc50a426cf to before 55fcdd1258faaecca74b91b88cc0921f9edd775dAffected
b9b17debc69d27cd55e21ee51a5ba7fc50a426cf to before 9dc373f74097edd0e35f3393d6248eda8d1ba99dAffected
b9b17debc69d27cd55e21ee51a5ba7fc50a426cf to before 8c06f34785068b87e2b560534c77c163d6c6dca7Affected
b9b17debc69d27cd55e21ee51a5ba7fc50a426cf to before e407495ba6788a67d1bd41714158c079e340879bAffected
b9b17debc69d27cd55e21ee51a5ba7fc50a426cf to before 6d72e7c767acbbdd44ebc7d89c6690b405b32b57Affected

LinuxLinux

4.9Affected
before 4.9Not affected
4.9.269 through 4.9.*Not affected
4.14.233 through 4.14.*Not affected
4.19.191 through 4.19.*Not affected
5.4.119 through 5.4.*Not affected
5.10.37 through 5.10.*Not affected
5.11.21 through 5.11.*Not affected
5.12.4 through 5.12.*Not affected
5.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.