Use-After-Free in Linux kernel (CVE-2021-47106)
Summary
Vulnerability in Linux kernel (CVE-2021-47106). Successful exploitation can lead to full system takeover.
Original description
The description as published by the source.
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy()
We need to use list_for_each_entry_safe() iterator
because we can not access @catchall after kfree_rcu() call.
syzbot reported:
BUG: KASAN: use-after-free in nft_set_catchall_destroy net/netfilter/nf_tables_api.c:4486 [inline]
BUG: KASAN: use-after-free in nft_set_destroy net/netfilter/nf_tables_api.c:4504 [inline]
BUG: KASAN: use-after-free in nft_set_destroy+0x3fd/0x4f0 net/netfilter/nf_tables_api.c:4493
Read of size 8 at addr ffff8880716e5b80 by task syz-executor.3/8871
CPU: 1 PID: 8871 Comm: syz-executor.3 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0x8d/0x2ed mm/kasan/report.c:247
__kasan_report mm/kasan/report.c:433 [inline]
kasan_report.cold+0x83/0xdf mm/kasan/report.c:450
nft_set_catchall_destroy net/netfilter/nf_tables_api.c:4486 [inline]
nft_set_destroy net/netfilter/nf_tables_api.c:4504 [inline]
nft_set_destroy+0x3fd/0x4f0 net/netfilter/nf_tables_api.c:4493
__nft_release_table+0x79f/0xcd0 net/netfilter/nf_tables_api.c:9626
nft_rcv_nl_event+0x4f8/0x670 net/netfilter/nf_tables_api.c:9688
notifier_call_chain+0xb5/0x200 kernel/notifier.c:83
blocking_notifier_call_chain kernel/notifier.c:318 […
Source: NIST National Vulnerability Database NVD
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2021-47106 has been found in Linux kernel.
Successful exploitation can lead to full system takeover. CVSS score: 7.8/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "Linux kernel CVE-2021-47106" on the vendor's site.
CVE-2021-47106 (Linux kernel) — CWE-416 / CVSS v3 7.8
Attack vector: local / no user interaction
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Use-after-free (CWE-416) exists in Linux kernel.
Check the vendor advisory for the affected versions of Linux kernel.
Severity: High (CVSS 7.8/10). Successful exploitation can lead to full system takeover.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
Audit SBOM/dependencies for affected components.資産台帳・SBOM・依存マニフェストで Linux kernel を使っているサービスとバージョンを洗い出す。
-
2Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2021-47106 linux Fixed in: 5.15.15-1
- Ubuntu UBUNTU-CVE-2021-47106 linux-hwe-edge
References
- patch git.kernel.org
- patch git.kernel.org