LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47215: net/mlx5e: kTLS, Fix crash in RX resync flow

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: kTLS, Fix crash in RX resync flow For the TLS RX resync flow, we maintain a list of TLS contexts that require some attention, to communicate their resync information to the HW. Here we fix list corruptions, by protecting the entries against movements coming from resync_handle_seq_match(), until their resync handling in napi is fully completed.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel crash bug in the mlx5e network driver kTLS receive resynchronization path. Systems using Mellanox mlx5 networking with kernel TLS receive offload are the most plausible concern. The public record does not provide CVSS, CWE, or evidence of active exploitation.

Executive priority

Treat as a targeted kernel stability risk, not a confirmed internet-wide emergency. Prioritize patch verification for high-availability Linux systems using Mellanox mlx5 networking or TLS offload, especially where crashes would affect critical services.

Technical view

The flaw involves list corruption in TLS RX resync handling. The fix protects TLS context entries from movement by resync_handle_seq_match() until NAPI resync processing completes. The source identifies Linux kernel as affected and links two stable kernel fixes, but does not provide exploit prerequisites or impact detail beyond crash behavior.

Likely exposure

Exposure appears limited to Linux systems using the mlx5e driver with kTLS RX resync functionality. Cloud, appliance, or server fleets using Mellanox ConnectX-class adapters may need kernel and offload configuration review. Exact distribution package exposure is not provided in the source bundle.

Exploitation context

The source bundle does not cite active exploitation, public exploit code, or CISA KEV listing. The described outcome is a crash from list corruption during a specific driver offload flow, but triggerability and attacker proximity are not established by the provided sources.

Researcher notes

Evidence is sparse: no CVSS, CWE, exploit status, or detailed affected distribution matrix is included. Analysis should center on the upstream stable commits, mlx5e kTLS RX resync code path, and downstream vendor backport status before asserting reachability or impact.

Mitigation direction

  • Apply vendor kernel updates that include the referenced stable fixes.
  • Check Linux distribution advisories for package-specific fixed versions.
  • Prioritize systems using mlx5e network adapters and kTLS offload.
  • If patching is delayed, review vendor guidance on disabling affected offload paths.

Validation and detection

  • Inventory Linux kernel versions and mlx5e driver usage across servers.
  • Confirm whether kTLS RX offload is enabled on exposed workloads.
  • Map installed distro kernel packages to vendor fixed versions.
  • Review kernel logs for mlx5e or TLS RX resync crash indicators.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47215 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe9ce991bce5bacf71641bd0f72f4b7c589529f40, e9ce991bce5bacf71641bd0f72f4b7c589529f40unaffected
LinuxLinux5.13, 0, 5.15.5, 5.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.