LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47199: net/mlx5e: CT, Fix multiple allocations and memleak of mod acts

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: CT, Fix multiple allocations and memleak of mod acts CT clear action offload adds additional mod hdr actions to the flow's original mod actions in order to clear the registers which hold ct_state. When such flow also includes encap action, a neigh update event can cause the driver to unoffload the flow and then reoffload it. Each time this happens, the ct clear handling adds that same set of mod hdr actions to reset ct_state until the max of mod hdr actions is reached. Also the driver never releases the allocated mod hdr actions and causing a memleak. Fix above two issues by moving CT clear mod acts allocation into the parsing actions phase and only use it when offloading the rule. The release of mod acts will be done in the normal flow_put(). backtrace: [<000000007316e2f3>] krealloc+0x83/0xd0 [<00000000ef157de1>] mlx5e_mod_hdr_alloc+0x147/0x300 [mlx5_core] [<00000000970ce4ae>] mlx5e_tc_match_to_reg_set_and_get_id+0xd7/0x240 [mlx5_core] [<0000000067c5fa17>] mlx5e_tc_match_to_reg_set+0xa/0x20 [mlx5_core] [<00000000d032eb98>] mlx5_tc_ct_entry_set_registers.isra.0+0x36/0xc0 [mlx5_core] [<00000000fd23b869>] mlx5_tc_ct_flow_offload+0x272/0x1f10 [mlx5_core] [<000000004fc24acc>] mlx5e_tc_offload_fdb_rules.part.0+0x150/0x620 [mlx5_core] [<00000000dc741c17>] mlx5e_tc_encap_flows_add+0x489/0x690 [mlx5_core] [<00000000e92e49d7>] mlx5e_rep_update_flows+0x6e4/0x9b0 [mlx5_core] [<00000000f60f5602>] mlx5e_rep_neigh_update+0x39a/0x5d0 [mlx5_core]

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel driver bug in Mellanox mlx5 networking offload handling. Under specific connection-tracking and encapsulation offload conditions, repeated reoffload events can duplicate internal modification actions and leak memory, risking network offload failure or host resource pressure.

Executive priority

Treat this as targeted infrastructure risk, not a broad internet emergency. Patch exposed network virtualization or high-throughput hosts first, especially where mlx5 hardware offload is relied on for production traffic.

Technical view

The mlx5e TC connection-tracking clear action repeatedly appended ct_state register-clearing mod header actions during neighbor-triggered unoffload/reoffload of encapsulated flows. The driver also failed to release allocated mod header actions. Kernel stable commits move allocation into action parsing and release through normal flow_put handling.

Likely exposure

Exposure appears limited to Linux systems using mlx5/mlx5e hardware offload paths with TC connection tracking clear actions and encapsulation. General Linux hosts without this driver, hardware, or offload configuration are unlikely to be exposed based on the provided sources.

Exploitation context

The bundle does not report active exploitation, and KEV is false. The described trigger is operational: neighbor update events causing affected flows to be unoffloaded and reoffloaded until action limits or memory pressure occur.

Researcher notes

Evidence supports a memory leak and repeated mod header allocation in mlx5e CT offload handling. The source bundle lacks CVSS, CWE, exploit evidence, and distribution-specific fixed versions, so exposure validation must be environment-specific.

Mitigation direction

  • Check the kernel vendor advisories for patched builds containing the referenced stable commits.
  • Prioritize updates on hosts using Mellanox mlx5 TC connection-tracking offload with encapsulation.
  • If immediate patching is unavailable, review vendor guidance for disabling affected offload paths.
  • Track distribution backports because fixed package versions may differ from upstream kernel versions.

Validation and detection

  • Inventory hosts running the mlx5_core or mlx5e driver.
  • Identify systems using TC hardware offload with connection tracking and encapsulation.
  • Compare installed kernel packages against vendor fixes for CVE-2021-47199.
  • Monitor affected hosts for mlx5e offload errors, action-limit failures, or unexplained memory growth.
Prepared
Confidence
medium
Sources
4

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47199 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1ef3018f5af3da6376fae546e4dfc3f05f063815, 1ef3018f5af3da6376fae546e4dfc3f05f063815unaffected
LinuxLinux5.7, 0, 5.15.5, 5.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.