LiveActive security incident?Get immediate response
CVE Record

CVE-2021-46915: netfilter: nft_limit: avoid possible divide error in nft_limit_init

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_limit: avoid possible divide error in nft_limit_init div_u64() divides u64 by u32. nft_limit_init() wants to divide u64 by u64, use the appropriate math function (div64_u64) divide error: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 8390 Comm: syz-executor188 Not tainted 5.12.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:div_u64_rem include/linux/math64.h:28 [inline] RIP: 0010:div_u64 include/linux/math64.h:127 [inline] RIP: 0010:nft_limit_init+0x2a2/0x5e0 net/netfilter/nft_limit.c:85 Code: ef 4c 01 eb 41 0f 92 c7 48 89 de e8 38 a5 22 fa 4d 85 ff 0f 85 97 02 00 00 e8 ea 9e 22 fa 4c 0f af f3 45 89 ed 31 d2 4c 89 f0 <49> f7 f5 49 89 c6 e8 d3 9e 22 fa 48 8d 7d 48 48 b8 00 00 00 00 00 RSP: 0018:ffffc90009447198 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000200000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff875152e6 RDI: 0000000000000003 RBP: ffff888020f80908 R08: 0000200000000000 R09: 0000000000000000 R10: ffffffff875152d8 R11: 0000000000000000 R12: ffffc90009447270 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 000000000097a300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200001c4 CR3: 0000000026a52000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: nf_tables_newexpr net/netfilter/nf_tables_api.c:2675 [inline] nft_expr_init+0x145/0x2d0 net/netfilter/nf_tables_api.c:2713 nft_set_elem_expr_alloc+0x27/0x280 net/netfilter/nf_tables_api.c:5160 nf_tables_newset+0x1997/0x3150 net/netfilter/nf_tables_api.c:4321 nfnetlink_rcv_batch+0x85a/0x21b0 net/netfilter/nfnetlink.c:456 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:580 [inline] nfnetlink_rcv+0x3af/0x420 net/netfilter/nfnetlink.c:598 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:674 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2021-46915 is a Linux kernel netfilter/nftables bug that can trigger a kernel divide error during limit rule initialization. The source evidence points to a crash-style reliability issue rather than confirmed data theft or remote compromise. Business urgency depends on whether affected Linux kernels run on exposed or multi-tenant systems.

Executive priority

Treat this as a kernel reliability risk with incomplete public severity data. Patch through normal kernel maintenance, accelerating for internet-facing, multi-tenant, or high-availability systems where a kernel crash would materially affect operations.

Technical view

In nft_limit_init(), the kernel used div_u64() where a u64-by-u64 division was needed. The bad arithmetic can raise a divide error while processing nftables/nfnetlink configuration paths. Upstream stable fixes replace the division helper with the correct 64-bit function.

Likely exposure

Systems running affected Linux kernel versions or downstream builds that include the vulnerable nft_limit code may be exposed. The CVE record lists Linux as affected and references stable fixes across multiple kernel branches; distro-specific package status must be verified separately.

Exploitation context

The bundle does not show CISA KEV listing or any cited active exploitation report. The included trace comes from syzkaller testing and shows a kernel crash path through nf_tables and nfnetlink. Required privileges or namespace conditions are not stated in the provided sources.

Researcher notes

Evidence supports a divide-error flaw in net/netfilter/nft_limit.c reached during nf_tables set/expression initialization. The sources do not provide CVSS, CWE, exploit maturity, or privilege requirements. Avoid assuming remote reachability without vendor or kernel configuration confirmation.

Mitigation direction

  • Apply vendor or distribution kernel updates containing the referenced stable fixes.
  • Prioritize systems using nftables/netfilter or hosting untrusted workloads.
  • Check distro advisories for exact fixed package versions.
  • Reboot systems after kernel update where required.
  • If patching is delayed, review vendor guidance for temporary controls.

Validation and detection

  • Inventory Linux kernel versions across servers, images, and appliances.
  • Map installed kernels to vendor advisories for CVE-2021-46915.
  • Confirm fixed kernels are running after update and reboot.
  • Review nftables/netfilter usage on affected hosts.
  • Monitor for kernel divide error or panic logs referencing nft_limit_init.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-46915 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
7Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc26844eda9d4fdbd266660e3b3de2d0270e3a1ed, c26844eda9d4fdbd266660e3b3de2d0270e3a1ed, c26844eda9d4fdbd266660e3b3de2d0270e3a1ed, c26844eda9d4fdbd266660e3b3de2d0270e3a1ed, c26844eda9d4fdbd266660e3b3de2d0270e3a1ed, c26844eda9d4fdbd266660e3b3de2d0270e3a1edunaffected
LinuxLinux4.13, 0, 4.14.232, 4.19.189, 5.4.114, 5.10.32, 5.11.16, 5.12affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.