LiveActive security incident?Get immediate response
CVE Record

CVE-2021-46936: net: fix use-after-free in tw_timer_handler

In the Linux kernel, the following vulnerability has been resolved: net: fix use-after-free in tw_timer_handler A real world panic issue was found as follow in Linux 5.4. BUG: unable to handle page fault for address: ffffde49a863de28 PGD 7e6fe62067 P4D 7e6fe62067 PUD 7e6fe63067 PMD f51e064067 PTE 0 RIP: 0010:tw_timer_handler+0x20/0x40 Call Trace: <IRQ> call_timer_fn+0x2b/0x120 run_timer_softirq+0x1ef/0x450 __do_softirq+0x10d/0x2b8 irq_exit+0xc7/0xd0 smp_apic_timer_interrupt+0x68/0x120 apic_timer_interrupt+0xf/0x20 This issue was also reported since 2017 in the thread [1], unfortunately, the issue was still can be reproduced after fixing DCCP. The ipv4_mib_exit_net is called before tcp_sk_exit_batch when a net namespace is destroyed since tcp_sk_ops is registered befrore ipv4_mib_ops, which means tcp_sk_ops is in the front of ipv4_mib_ops in the list of pernet_list. There will be a use-after-free on net->mib.net_statistics in tw_timer_handler after ipv4_mib_exit_net if there are some inflight time-wait timers. This bug is not introduced by commit f2bf415cfed7 ("mib: add net to NET_ADD_STATS_BH") since the net_statistics is a global variable instead of dynamic allocation and freeing. Actually, commit 61a7e26028b9 ("mib: put net statistics on struct net") introduces the bug since it put net statistics on struct net and free it when net namespace is destroyed. Moving init_ipv4_mibs() to the front of tcp_init() to fix this bug and replace pr_crit() with panic() since continuing is meaningless when init_ipv4_mibs() fails. [1] https://groups.google.com/g/syzkaller/c/p1tn-_Kc6l4/m/smuL_FMAAgAJ?pli=1

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-46936 is a Linux kernel networking bug that can leave a timer using freed network-namespace statistics memory. The described real-world impact is a kernel panic in Linux 5.4, meaning affected systems may crash rather than leak data or grant access based on the provided evidence.

Executive priority

Patch through normal kernel maintenance, with elevated priority for container infrastructure where namespace teardown is common. The known impact is system crash risk, not confirmed remote code execution or active exploitation from the provided sources.

Technical view

The flaw is a use-after-free in `tw_timer_handler`. During network namespace teardown, `ipv4_mib_exit_net` can free `net->mib.net_statistics` before TCP time-wait timers finish. The kernel fix reorders IPv4 MIB initialization relative to TCP setup so teardown ordering avoids stale timer access.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel versions, especially hosts using network namespaces such as container platforms. The source lists affected Linux kernel lines including 4.4.298, 4.9.296, 4.14.261, 4.19.224, 5.4.170, 5.10.90, 5.15.13, and 5.16.

Exploitation context

The bundle cites a real-world kernel panic and earlier syzkaller discussion, but it does not cite active exploitation. CISA KEV status is false, so treat this as reliability and denial-of-service risk unless new evidence emerges.

Researcher notes

The root cause is ordering in per-network-namespace cleanup after `61a7e26028b9` moved network statistics into `struct net`. Evidence is strongest for crash behavior in Linux 5.4. The bundle does not provide CVSS, exploit prerequisites, or proof of arbitrary code execution.

Mitigation direction

  • Update affected Linux kernels to vendor builds containing the referenced stable fixes.
  • Prioritize container hosts and systems that frequently create or destroy network namespaces.
  • Check distribution advisories for exact fixed package versions before rollout.
  • Reboot into the fixed kernel after installation; kernel updates are not complete until active.
  • If patching is delayed, monitor high-churn namespace workloads more closely.

Validation and detection

  • Inventory running kernel versions and compare them with vendor fixed releases.
  • Verify vendor changelogs reference CVE-2021-46936 or the listed stable commits.
  • Confirm systems have rebooted into the fixed kernel after update.
  • Review kernel logs for `tw_timer_handler` panics or related page faults.
  • Check container hosts separately from general-purpose servers.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-46936 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux61a7e26028b94805fd686a6dc9dbd9941f8f19b0, 61a7e26028b94805fd686a6dc9dbd9941f8f19b0, 61a7e26028b94805fd686a6dc9dbd9941f8f19b0, 61a7e26028b94805fd686a6dc9dbd9941f8f19b0, 61a7e26028b94805fd686a6dc9dbd9941f8f19b0, 61a7e26028b94805fd686a6dc9dbd9941f8f19b0, 61a7e26028b94805fd686a6dc9dbd9941f8f19b0, 61a7e26028b94805fd686a6dc9dbd9941f8f19b0unaffected
LinuxLinux2.6.27, 0, 4.4.298, 4.9.296, 4.14.261, 4.19.224, 5.4.170, 5.10.90, 5.15.13, 5.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.