CVE-2021-47588

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.16.0-rc5-syzkaller

Description The vulnerability is related to a memory corruption issue in the sit init net() function. The ipip6 dev free() function is called from sit init net(), but it is already called by register netdevice() if something goes wrong. This can lead to a dst release underflow. The vulnerability was reported by syzbot and is related to the dst release function in the net/core/dst.c file.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix for this vulnerability. As a temporary workaround, consider disabling the ipip6 dev free() function until a patch is available. However, this may have unintended consequences and should be done with caution.

At the moment, there is no information about a newer version that contains a fix for this vulnerability.