CVE-2021-47199: net/mlx5e: CT, Fix multiple allocations and memleak of mod acts
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: CT, Fix multiple allocations and memleak of mod acts
CT clear action offload adds additional mod hdr actions to the
flow's original mod actions in order to clear the registers which
hold ct_state.
When such flow also includes encap action, a neigh update event
can cause the driver to unoffload the flow and then reoffload it.
Each time this happens, the ct clear handling adds that same set
of mod hdr actions to reset ct_state until the max of mod hdr
actions is reached.
Also the driver never releases the allocated mod hdr actions and
causing a memleak.
Fix above two issues by moving CT clear mod acts allocation
into the parsing actions phase and only use it when offloading the rule.
The release of mod acts will be done in the normal flow_put().
backtrace:
[<000000007316e2f3>] krealloc+0x83/0xd0
[<00000000ef157de1>] mlx5e_mod_hdr_alloc+0x147/0x300 [mlx5_core]
[<00000000970ce4ae>] mlx5e_tc_match_to_reg_set_and_get_id+0xd7/0x240 [mlx5_core]
[<0000000067c5fa17>] mlx5e_tc_match_to_reg_set+0xa/0x20 [mlx5_core]
[<00000000d032eb98>] mlx5_tc_ct_entry_set_registers.isra.0+0x36/0xc0 [mlx5_core]
[<00000000fd23b869>] mlx5_tc_ct_flow_offload+0x272/0x1f10 [mlx5_core]
[<000000004fc24acc>] mlx5e_tc_offload_fdb_rules.part.0+0x150/0x620 [mlx5_core]
[<00000000dc741c17>] mlx5e_tc_encap_flows_add+0x489/0x690 [mlx5_core]
[<00000000e92e49d7>] mlx5e_rep_update_flows+0x6e4/0x9b0 [mlx5_core]
[<00000000f60f5602>] mlx5e_rep_neigh_update+0x39a/0x5d0 [mlx5_core]
Security readout for executives and security teams
Plain-English summary
This is a Linux kernel driver bug in Mellanox mlx5 networking offload handling. Under specific connection-tracking and encapsulation offload conditions, repeated reoffload events can duplicate internal modification actions and leak memory, risking network offload failure or host resource pressure.
Executive priority
Treat this as targeted infrastructure risk, not a broad internet emergency. Patch exposed network virtualization or high-throughput hosts first, especially where mlx5 hardware offload is relied on for production traffic.
Technical view
The mlx5e TC connection-tracking clear action repeatedly appended ct_state register-clearing mod header actions during neighbor-triggered unoffload/reoffload of encapsulated flows. The driver also failed to release allocated mod header actions. Kernel stable commits move allocation into action parsing and release through normal flow_put handling.
Likely exposure
Exposure appears limited to Linux systems using mlx5/mlx5e hardware offload paths with TC connection tracking clear actions and encapsulation. General Linux hosts without this driver, hardware, or offload configuration are unlikely to be exposed based on the provided sources.
Exploitation context
The bundle does not report active exploitation, and KEV is false. The described trigger is operational: neighbor update events causing affected flows to be unoffloaded and reoffloaded until action limits or memory pressure occur.
Researcher notes
Evidence supports a memory leak and repeated mod header allocation in mlx5e CT offload handling. The source bundle lacks CVSS, CWE, exploit evidence, and distribution-specific fixed versions, so exposure validation must be environment-specific.
Mitigation direction
Check the kernel vendor advisories for patched builds containing the referenced stable commits.
Prioritize updates on hosts using Mellanox mlx5 TC connection-tracking offload with encapsulation.
If immediate patching is unavailable, review vendor guidance for disabling affected offload paths.
Track distribution backports because fixed package versions may differ from upstream kernel versions.
Validation and detection
Inventory hosts running the mlx5_core or mlx5e driver.
Identify systems using TC hardware offload with connection tracking and encapsulation.
Compare installed kernel packages against vendor fixes for CVE-2021-47199.
Monitor affected hosts for mlx5e offload errors, action-limit failures, or unexplained memory growth.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2021-47199 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.