{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2021-47099 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2021-47099 is a high-severity vulnerability in Linux kernel, published on 4 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2021-47099 and fix it if it is affected.\n\nWhat it is: CVE-2021-47099 is a high-severity vulnerability in Linux kernel, published on 4 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2021-47099 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2021-47099/ (Markdown: https://insights.sbomify.com/CVE-2021-47099/index.md)","id":"CVE-2021-47099","markdown":"https://insights.sbomify.com/CVE-2021-47099/index.md","name":"CVE-2021-47099","record":{"aliases":["DEBIAN-CVE-2021-47099","GHSA-7xc6-rqxq-w4qm","UBUNTU-CVE-2021-47099"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A kernel bug in the veth driver causes a crash when cloned skbs enter GRO, leading to denial of service.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nveth: ensure skb entering GRO are not cloned.\n\nAfter commit d3256efd8e8b (\"veth: allow enabling NAPI even without XDP\"),\nif GRO is enabled on a veth device and TSO is disabled on the peer\ndevice, TCP skbs will go through the NAPI callback. If there is no XDP\nprogram attached, the veth code does not perform any share check, and\nshared/cloned skbs could enter the GRO engine.\n\nIgnat reported a BUG triggered later-on due to the above condition:\n\n[   53.970529][    C1] kernel BUG at net/core/skbuff.c:3574!\n[   53.981755][    C1] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\n[   53.982634][    C1] CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc5+ #25\n[   53.982634][    C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n[   53.982634][    C1] RIP: 0010:skb_shift+0x13ef/0x23b0\n[   53.982634][    C1] Code: ea 03 0f b6 04 02 48 89 fa 83 e2 07 38 d0\n7f 08 84 c0 0f 85 41 0c 00 00 41 80 7f 02 00 4d 8d b5 d0 00 00 00 0f\n85 74 f5 ff ff \u003c0f\u003e 0b 4d 8d 77 20 be 04 00 00 00 4c 89 44 24 78 4c 89\nf7 4c 89 8c\n[   53.982634][    C1] RSP: 0018:ffff8881008f7008 EFLAGS: 00010246\n[   53.982634][    C1] RAX: 0000000000000000 RBX: ffff8881180b4c80 RCX: 0000000000000000\n[   53.982634][    C1] RDX: 0000000000000002 RSI: ffff8881180b4d3c RDI: ffff88810bc9cac2\n[   53.982634][    C1] RBP: ffff8881008f70b8 R08: ffff8881180b4cf4 R09: ffff8881180b4cf0\n[   53.982634][    C1] R10: ffffed1022999e5c R11: 0000000000000002 R12: 0000000000000590\n[   53.982634][    C1] R13: ffff88810f940c80 R14: ffff88810f940d50 R15: ffff88810bc9cac0\n[   53.982634][    C1] FS:  0000000000000000(0000) GS:ffff888235880000(0000) knlGS:0000000000000000\n[   53.982634][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   53.982634][    C1] CR2: 00007ff5f9b86680 CR3: 0000000108ce8004 CR4: 0000000000170ee0\n[   53.982634][    C1] Call Trace:\n[   53.982634][    C1]  \u003cTASK\u003e\n[   53.982634][    C1]  tcp_sacktag_walk+0xaba/0x18e0\n[   53.982634][    C1]  tcp_sacktag_write_queue+0xe7b/0x3460\n[   53.982634][    C1]  tcp_ack+0x2666/0x54b0\n[   53.982634][    C1]  tcp_rcv_established+0x4d9/0x20f0\n[   53.982634][    C1]  tcp_v4_do_rcv+0x551/0x810\n[   53.982634][    C1]  tcp_v4_rcv+0x22ed/0x2ed0\n[   53.982634][    C1]  ip_protocol_deliver_rcu+0x96/0xaf0\n[   53.982634][    C1]  ip_local_deliver_finish+0x1e0/0x2f0\n[   53.982634][    C1]  ip_sublist_rcv_finish+0x211/0x440\n[   53.982634][    C1]  ip_list_rcv_finish.constprop.0+0x424/0x660\n[   53.982634][    C1]  ip_list_rcv+0x2c8/0x410\n[   53.982634][    C1]  __netif_receive_skb_list_core+0x65c/0x910\n[   53.982634][    C1]  netif_receive_skb_list_internal+0x5f9/0xcb0\n[   53.982634][    C1]  napi_complete_done+0x188/0x6e0\n[   53.982634][    C1]  gro_cell_poll+0x10c/0x1d0\n[   53.982634][    C1]  __napi_poll+0xa1/0x530\n[   53.982634][    C1]  net_rx_action+0x567/0x1270\n[   53.982634][    C1]  __do_softirq+0x28a/0x9ba\n[   53.982634][    C1]  run_ksoftirqd+0x32/0x60\n[   53.982634][    C1]  smpboot_thread_fn+0x559/0x8c0\n[   53.982634][    C1]  kthread+0x3b9/0x490\n[   53.982634][    C1]  ret_from_fork+0x22/0x30\n[   53.982634][    C1]  \u003c/TASK\u003e\n\nAddress the issue by skipping the GRO stage for shared or cloned skbs.\nTo reduce the chance of OoO, try to unclone the skbs before giving up.\n\nv1 -\u003e v2:\n - use avoid skb_copy and fallback to netif_receive_skb  - Eric","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"veth: ensure skb entering GRO are not cloned.","id":"CVE-2021-47099","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"null_dereference","year":"2021"},"n_packages":0,"n_references":2,"next":{"headline":"ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module","id":"CVE-2021-47100"},"packages":[],"prev":{"headline":"hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations","id":"CVE-2021-47098"},"products":["Linux"],"published":"2024-03-04","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-05","vendors":["Linux"]},"summary":"A kernel bug in the veth driver causes a crash when cloned skbs enter GRO, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2021-47099/"}