CVE-2021-47352

virtio-net: Add validation for used length

State: Published
Severity: 8.4 High
Published: May 21, 2024
Updated: Aug 5, 2026
Reserved: May 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

virtio-net: Add validation for used length

This adds validation for used length (might come from an untrusted device) to avoid data corruption or loss.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f6b10209b90d48a84f886ab2b317b5d2cbfe3143 to before c1b40d1959517ff2ea473d40eeab4691d6d62462Affected f6b10209b90d48a84f886ab2b317b5d2cbfe3143 to before c92298d228f61589dd21657af2bea95fc866b813Affected f6b10209b90d48a84f886ab2b317b5d2cbfe3143 to before 3133e01514c3c498f2b01ff210ee6134b70c663cAffected f6b10209b90d48a84f886ab2b317b5d2cbfe3143 to before ba710baa1cc1b17a0483f7befe03e696efd17292Affected f6b10209b90d48a84f886ab2b317b5d2cbfe3143 to before ad993a95c508417acdeb15244109e009e50d8758Affected
LinuxLinux	4.11Affected before 4.11Not affected 5.4.293 through 5.4.Not affected 5.10.51 through 5.10.Not affected 5.12.18 through 5.12.Not affected 5.13.3 through 5.13.Not affected 5.14 and laterNot affected

Product

Versions

LinuxLinux

f6b10209b90d48a84f886ab2b317b5d2cbfe3143 to before c1b40d1959517ff2ea473d40eeab4691d6d62462Affected
f6b10209b90d48a84f886ab2b317b5d2cbfe3143 to before c92298d228f61589dd21657af2bea95fc866b813Affected
f6b10209b90d48a84f886ab2b317b5d2cbfe3143 to before 3133e01514c3c498f2b01ff210ee6134b70c663cAffected
f6b10209b90d48a84f886ab2b317b5d2cbfe3143 to before ba710baa1cc1b17a0483f7befe03e696efd17292Affected
f6b10209b90d48a84f886ab2b317b5d2cbfe3143 to before ad993a95c508417acdeb15244109e009e50d8758Affected

LinuxLinux

4.11Affected
before 4.11Not affected
5.4.293 through 5.4.*Not affected
5.10.51 through 5.10.*Not affected
5.12.18 through 5.12.*Not affected
5.13.3 through 5.13.*Not affected
5.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.