LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47036: udp: skip L4 aggregation for UDP tunnel packets

In the Linux kernel, the following vulnerability has been resolved: udp: skip L4 aggregation for UDP tunnel packets If NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD are enabled, and there are UDP tunnels available in the system, udp_gro_receive() could end-up doing L4 aggregation (either SKB_GSO_UDP_L4 or SKB_GSO_FRAGLIST) at the outer UDP tunnel level for packets effectively carrying and UDP tunnel header. That could cause inner protocol corruption. If e.g. the relevant packets carry a vxlan header, different vxlan ids will be ignored/ aggregated to the same GSO packet. Inner headers will be ignored, too, so that e.g. TCP over vxlan push packets will be held in the GRO engine till the next flush, etc. Just skip the SKB_GSO_UDP_L4 and SKB_GSO_FRAGLIST code path if the current packet could land in a UDP tunnel, and let udp_gro_receive() do GRO via udp_sk(sk)->gro_receive. The check implemented in this patch is broader than what is strictly needed, as the existing UDP tunnel could be e.g. configured on top of a different device: we could end-up skipping GRO at-all for some packets. Anyhow, that is a very thin corner case and covering it will add quite a bit of complexity. v1 -> v2: - hopefully clarify the commit message

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel flaw can mishandle network traffic carried inside UDP tunnels. In affected configurations, the kernel may merge packets that should stay separate, potentially corrupting tunneled traffic such as VXLAN. The sources do not provide a CVSS score, confirmed exploitation, or business-impact frequency, so urgency depends on whether these kernel versions and tunnel features are used.

Executive priority

Treat as targeted operational risk for Linux networking and virtualization environments using UDP tunnels. Prioritize confirmation and vendor patching where VXLAN or similar tunneling is business-critical. For general servers without tunnel use, handle through normal kernel maintenance unless vendor guidance raises severity.

Technical view

With NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD enabled and UDP tunnels present, udp_gro_receive() could perform outer UDP L4 aggregation on packets containing tunnel headers. The CVE cites VXLAN as an example where different VXLAN IDs may be aggregated together and inner headers ignored. Stable commits skip SKB_GSO_UDP_L4 and SKB_GSO_FRAGLIST paths for possible UDP tunnel packets.

Likely exposure

Most relevant to Linux systems running affected kernel versions with UDP tunnel usage and the named GRO features enabled. Exposure is lower for hosts without UDP tunnel configurations. The source bundle does not identify affected distributions, appliances, or cloud services.

Exploitation context

The provided sources do not report active exploitation, public exploit use, or KEV listing. The described issue is a kernel networking correctness flaw that may corrupt tunneled traffic, not a source-confirmed remote code execution path.

Researcher notes

Evidence is limited to the CVE record and two Linux stable commit references. The commit rationale describes broad detection that may skip GRO more than strictly necessary to avoid tunnel corruption. No CWE, CVSS, exploit maturity, or distribution-specific fixed package data is provided in the bundle.

Mitigation direction

  • Review vendor kernel advisories for packages containing the referenced stable fixes.
  • Prioritize updates on hosts using UDP tunnels such as VXLAN.
  • Where patching is delayed, assess whether the named GRO features can be safely disabled.
  • Avoid ad hoc mitigations without vendor or platform guidance.
  • Track distribution backports rather than relying only on upstream version numbers.

Validation and detection

  • Inventory Linux kernel versions on systems carrying UDP tunneled traffic.
  • Identify hosts using UDP tunnels and the named GRO capabilities.
  • Confirm whether vendor kernels include the referenced upstream stable commits.
  • Monitor tunneled workloads for unexplained packet corruption or transport stalls.
  • Document any compensating configuration changes and rollback criteria.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47036 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux9fd1ff5d2ac7181844735806b0a703c942365291, 9fd1ff5d2ac7181844735806b0a703c942365291unaffected
LinuxLinux5.6, 0, 5.12.4, 5.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.