Security readout for executives and security teams
Plain-English summary
This is a Linux kernel Open vSwitch bug where IPv4 packet fragmentation can read outside a stack object. The public record shows a kernel memory-safety flaw, not confirmed real-world exploitation. Business urgency depends on whether systems run affected Linux kernels with Open vSwitch packet processing in use.
Executive priority
Handle through normal kernel patch governance, with higher priority for virtualization, container networking, SDN, or network appliance hosts using Open vSwitch. There is no source-backed evidence of active exploitation in this bundle.
Technical view
In ovs_fragment(), IPv4 handling used a temporary dst_entry where later code treated it as rtable. During ip_do_fragment(), fields such as rt_mtu_locked could be read out of bounds on the stack. The fix changes the IPv4 temporary object to match the expected structure, similar to existing IPv6 handling.
Likely exposure
Likely limited to Linux systems running affected kernel versions or commit ranges with the Open vSwitch kernel module and IPv4 fragmentation paths in use. The source data is kernel-centric and does not identify specific distributions, appliances, or cloud products.
Exploitation context
The record describes a KASAN-detected stack out-of-bounds read during testing. KEV is false, and the provided sources do not cite active exploitation, public exploit availability, or attacker prerequisites. Treat exploitability as unconfirmed from this bundle.
Researcher notes
The root cause is a type/structure mismatch in the IPv4 fragmentation path inside Open vSwitch. The public record gives strong root-cause detail and upstream fix references, but lacks CVSS, CWE, distro impact, and exploitability analysis.
Mitigation direction
- Apply vendor Linux kernel updates that include the referenced stable fixes.
- Prioritize hosts using Open vSwitch for production network virtualization or switching.
- Check distribution advisories for backported fixes in vendor kernel packages.
- If patching is delayed, follow vendor guidance for reducing Open vSwitch exposure.
Validation and detection
- Inventory Linux kernel versions on systems using Open vSwitch.
- Confirm whether the Open vSwitch kernel module is loaded or required.
- Check kernel changelogs for the named Open vSwitch fragmentation fix.
- Map installed kernels to vendor advisories or upstream stable commit coverage.
- Verify no unsupported or self-built affected kernels remain in service.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit b1d7280f9ba1
- Linux stable commit 23e17ec1a5eb
- Linux stable commit 5a52fa8ad45b
- Linux stable commit df9e900de246
- Linux stable commit 490ad0a23904
- Linux stable commit a1478374b0bd
- Linux stable commit d841d3cf5297
- Linux stable commit b3502b04e84a
- Linux stable commit 7c0ea5930c1c
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-46955 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b1d7280f9ba1bfdbc3af5bdb82e51f014854f26fCVE reference, Linux
- https://git.kernel.org/stable/c/23e17ec1a5eb53fe39cc34fa5592686d5acd0dacCVE reference, Linux
- https://git.kernel.org/stable/c/5a52fa8ad45b5a593ed416adf326538638454ff1CVE reference, Linux
- https://git.kernel.org/stable/c/df9e900de24637be41879e2c50afb713ec4e8b2eCVE reference, Linux
- https://git.kernel.org/stable/c/490ad0a2390442d0a7b8c00972a83dbb09cab142CVE reference, Linux
- https://git.kernel.org/stable/c/a1478374b0bda89b4277a8afd39208271faad4beCVE reference, Linux
- https://git.kernel.org/stable/c/d841d3cf5297fde4ce6a41ff35451d0e82917f3eCVE reference, Linux
- https://git.kernel.org/stable/c/b3502b04e84ac5349be95fc033c17bd701d2787aCVE reference, Linux
- https://git.kernel.org/stable/c/7c0ea5930c1c211931819d83cfb157bff1539a4cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.