LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47164: net/mlx5e: Fix null deref accessing lag dev

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix null deref accessing lag dev It could be the lag dev is null so stop processing the event. In bond_enslave() the active/backup slave being set before setting the upper dev so first event is without an upper dev. After setting the upper dev with bond_master_upper_dev_link() there is a second event and in that event we have an upper dev.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2021-47164 is a Linux kernel bug in the mlx5e networking path. During bonding or LAG state changes, the kernel may try to use a missing LAG device pointer, causing a null dereference. Business impact is most likely service instability on affected Linux hosts, especially network-heavy systems using this driver and bonding.

Executive priority

Track as an operational stability issue until vendor severity data says otherwise. Prioritize patching on critical Linux servers using mlx5e networking and bonded links, because a kernel null dereference can disrupt availability even without confirmed exploitation.

Technical view

The resolved issue is in net/mlx5e event handling. During bond_enslave(), an active/backup slave event can occur before the upper device is linked, leaving the LAG device null. The fix stops processing that event when the LAG device is absent. Public sources do not provide CVSS, CWE, or exploitability detail.

Likely exposure

Exposure appears limited to affected Linux kernel builds using the mlx5e networking driver with bonding or LAG behavior. The source lists affected Linux versions including 5.8 and fixed stable points including 5.10.42, 5.12.9, and 5.13, but distribution backports must be checked separately.

Exploitation context

CISA KEV is false in the supplied bundle, and no cited source reports active exploitation. The record describes a kernel null dereference caused by event ordering, not a remote exploit chain. Treat exploitation prerequisites as uncertain unless vendor advisories provide more detail.

Researcher notes

Evidence is narrow: the public description and stable commits identify the bug condition and fix direction, but not attack vector, privileges, CVSS, or observed exploitation. Validate against exact distro kernel source because enterprise kernels often backport fixes without changing upstream version numbers.

Mitigation direction

  • Update affected Linux kernels using vendor-supported packages or stable fixes.
  • Verify distro advisories for backported fixes matching the referenced kernel commits.
  • Prioritize hosts using mlx5e with bonding, active-backup, or LAG configurations.
  • Monitor vendor guidance if running custom or pinned kernel builds.

Validation and detection

  • Inventory kernel versions against vendor advisories and referenced stable commits.
  • Identify systems using mlx5e networking and bonded interfaces.
  • Review kernel logs for null dereference or oops events during bonding changes.
  • Confirm updated packages include the relevant Linux stable fix.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47164 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7e51891a237f9ea319f53f9beb83afb0077d88e6, 7e51891a237f9ea319f53f9beb83afb0077d88e6, 7e51891a237f9ea319f53f9beb83afb0077d88e6unaffected
LinuxLinux5.8, 0, 5.10.42, 5.12.9, 5.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.