LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt

In the Linux kernel, the following vulnerability has been resolved: net: vlan: fix underflow for the real_dev refcnt Inject error before dev_hold(real_dev) in register_vlan_dev(), and execute the following testcase: ip link add dev dummy1 type dummy ip link add name dummy1.100 link dummy1 type vlan id 100 ip link del dev dummy1 When the dummy netdevice is removed, we will get a WARNING as following: ======================================================================= refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 2 PID: 0 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0 and an endless loop of: ======================================================================= unregister_netdevice: waiting for dummy1 to become free. Usage count = -1073741824 That is because dev_put(real_dev) in vlan_dev_free() be called without dev_hold(real_dev) in register_vlan_dev(). It makes the refcnt of real_dev underflow. Move the dev_hold(real_dev) to vlan_dev_init() which is the call-back of ndo_init(). That makes dev_hold() and dev_put() for vlan's real_dev symmetrical.

MediumCVSS 4.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-47555 is a Linux kernel VLAN bug that can mishandle a network device reference count. A local low-privileged attacker may be able to trigger kernel warnings, resource leakage, or a stuck network-device cleanup path. The business impact is mainly local availability risk, not remote compromise.

Executive priority

Treat as a routine but real kernel maintenance item. It does not show remote compromise or confirmed exploitation, but local availability impact matters on shared Linux infrastructure and systems that rely on stable network device lifecycle behavior.

Technical view

The issue is in Linux VLAN registration cleanup. If an error occurs before dev_hold(real_dev), vlan_dev_free() can still call dev_put(real_dev), underflowing the real device refcount. The described result is refcount warnings and unregister_netdevice repeatedly waiting for the underlying device to become free.

Likely exposure

Exposure is limited to Linux systems with vulnerable kernel code where a local user can exercise VLAN or network device operations. The source bundle does not provide a complete distribution mapping, so fleet exposure requires checking installed kernel builds against vendor advisories and the referenced stable fixes.

Exploitation context

The CVSS vector is local, low complexity, low privileges, and no user interaction. The bundle says KEV is false and provides no evidence of active exploitation. The public description includes a reproducer scenario, but no weaponized exploit or remote attack path is cited.

Researcher notes

The evidence supports a refcount symmetry bug in VLAN device initialization and free paths. The bundle cites fixed stable commits and fixed-version entries, but affected version boundaries and downstream distro backports are incomplete. Validate exposure through vendor kernel changelogs, not upstream version strings alone.

Mitigation direction

  • Apply kernel updates containing the referenced stable commits.
  • Check Linux distribution advisories for fixed kernel package versions.
  • Prioritize shared hosts where untrusted users have local access.
  • Limit unnecessary local network administration privileges until patched.

Validation and detection

  • Inventory Linux kernel versions across affected systems.
  • Confirm whether vendor kernels include the referenced stable fixes.
  • Review logs for refcount warnings involving VLAN or netdevice cleanup.
  • Test patched kernels in staging before production rollout.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47555 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.4CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L1.82.5CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

4.4Medium
CVSS 3.1 vector shape for CVE-2021-47555Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux700602b662d7eaa816b1a3cb0abe7a85de358fd4, e04a7a84bb77f9cdf4475340fe931389bc72331c, 21032425c36ff85f16e72ca92193a8c401e4acd5, 563bcbae3ba233c275c244bfce2efe12938f5363, fca96b3f852a1b369b7b2844ce357cd689879934unaffected
LinuxLinux5.4.160, 5.10.80, 5.15.3unaffected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.