Security readout for executives and security teams
Plain-English summary
This Linux kernel bug can make the kernel read just past a small stack object while handling a specific IPv4 traffic-control path. The public record shows it is fixed in stable kernel commits, but does not provide CVSS, confirmed exploitation, or clear business impact details.
Executive priority
Treat as a targeted Linux kernel maintenance issue unless your environment heavily uses traffic control. Patch through normal kernel update channels, with higher priority for network-intensive infrastructure and platforms running custom tc policy.
Technical view
The flaw is in net/sched sch_frag when act_mirred fragments IPv4 packets previously reassembled by act_ct. sch_fragment used a temporary dst_entry where later IPv4 code treated it as rtable, causing a stack out-of-bounds read observed by KASAN in ip_do_fragment.
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions and using the relevant traffic-control actions, especially act_ct with act_mirred on IPv4 fragmentation paths. The bundle lists Linux kernel affected versions and stable commit references, but not distribution-specific package status.
Exploitation context
The source bundle reports no CISA KEV listing and provides no evidence of active exploitation. It includes a KASAN crash trace and root-cause explanation, not public exploit activity or weaponized use.
Researcher notes
The key condition is type confusion-like misuse of dst_entry as rtable in the IPv4 fragmentation path. The source does not state confidentiality impact, crash reliability, privilege requirements, or remote reachability, so exploitability assessment remains incomplete.
Mitigation direction
- Review vendor kernel advisories for your Linux distributions.
- Update to kernel builds containing the referenced stable fixes.
- Prioritize systems using Linux traffic control, act_ct, act_mirred, or cls_flower.
- Check network appliances and container hosts that expose advanced tc configurations.
Validation and detection
- Inventory running kernel versions across Linux hosts.
- Compare installed kernels against vendor advisories and stable fix commits.
- Review tc configurations for act_ct, act_mirred, and IPv4 mirroring paths.
- Confirm patched kernels are booted, not merely installed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-46954 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/018bb8da5b5888e19585f9b802f036afe643fcefCVE reference, Linux
- https://git.kernel.org/stable/c/8e6dfb7beeb6489ac1365b8a71052e737f5da76eCVE reference, Linux
- https://git.kernel.org/stable/c/31fe34a0118e0acc958c802e830ad5d37ef6b1d3CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.