LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47363: nexthop: Fix division by zero while replacing a resilient group

In the Linux kernel, the following vulnerability has been resolved: nexthop: Fix division by zero while replacing a resilient group The resilient nexthop group torture tests in fib_nexthop.sh exposed a possible division by zero while replacing a resilient group [1]. The division by zero occurs when the data path sees a resilient nexthop group with zero buckets. The tests replace a resilient nexthop group in a loop while traffic is forwarded through it. The tests do not specify the number of buckets while performing the replacement, resulting in the kernel allocating a stub resilient table (i.e, 'struct nh_res_table') with zero buckets. This table should never be visible to the data path, but the old nexthop group (i.e., 'oldg') might still be used by the data path when the stub table is assigned to it. Fix this by only assigning the stub table to the old nexthop group after making sure the group is no longer used by the data path. Tested with fib_nexthops.sh: Tests passed: 222 Tests failed: 0 [1] divide error: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 1850 Comm: ping Not tainted 5.14.0-custom-10271-ga86eb53057fe #1107 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014 RIP: 0010:nexthop_select_path+0x2d2/0x1a80 [...] Call Trace: fib_select_multipath+0x79b/0x1530 fib_select_path+0x8fb/0x1c10 ip_route_output_key_hash_rcu+0x1198/0x2da0 ip_route_output_key_hash+0x190/0x340 ip_route_output_flow+0x21/0x120 raw_sendmsg+0x91d/0x2e10 inet_sendmsg+0x9e/0xe0 __sys_sendto+0x23d/0x360 __x64_sys_sendto+0xe1/0x1b0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can crash affected systems when resilient nexthop routing groups are replaced while traffic uses them. The public record describes a division-by-zero bug in the networking path. It appears primarily relevant to systems using advanced Linux routing features, not ordinary application servers without that configuration.

Executive priority

Treat as a targeted availability risk for Linux networking infrastructure. Prioritize network appliances, routers, cloud nodes, and hosts using advanced routing. Broad emergency action is not supported by the provided evidence.

Technical view

The kernel could expose a stub resilient nexthop table with zero buckets to the data path during group replacement. When traffic selection reached nexthop_select_path, division by zero could occur. The fix delays assigning the stub table to the old group until it is no longer used by the data path.

Likely exposure

Exposure is most likely on Linux systems using resilient nexthop groups or multipath routing. The bundle lists Linux kernel versions including 5.13, 5.14.9, and 5.15 as affected evidence, but distro-specific backports must be checked.

Exploitation context

The source describes discovery through kernel nexthop torture tests while traffic was forwarded. There is no KEV listing, no CVSS score, and no cited evidence of active exploitation in the provided bundle.

Researcher notes

The record provides strong root-cause detail but limited operational exploitability evidence. Validation should focus on kernel lineage, distro patches, and whether resilient nexthop groups can be exercised in production workflows.

Mitigation direction

  • Review vendor kernel advisories for CVE-2021-47363 and related stable fixes.
  • Update affected Linux kernels through the distribution’s supported kernel channel.
  • Prioritize hosts using resilient nexthop groups, multipath routing, or advanced routing automation.
  • Avoid relying on upstream version numbers alone; confirm distro backports.

Validation and detection

  • Inventory Linux kernel versions across routing and network-forwarding hosts.
  • Identify systems configured with resilient nexthop groups or multipath routing.
  • Check whether vendor kernels include the referenced upstream stable commits.
  • Monitor affected hosts for unexplained kernel crashes during route replacement activity.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47363 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux283a72a5599e80750699d2021830a294ed9ab3f3, 283a72a5599e80750699d2021830a294ed9ab3f3unaffected
LinuxLinux5.13, 0, 5.14.9, 5.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.