{
  "cveId": "CVE-2021-47082",
  "url": "https://patchblox.com/security/cve/CVE-2021-47082",
  "summary": "CVE-2021-47082 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47082, released March 4, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  tun: avoid double free in tun_free_netdev  Avoid...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  tun: avoid double free in tun_free_netdev  Avoid double free in tun_free_netdev() by moving the dev-\u003Etstats and tun-\u003Esecurity allocs to a new ndo_init routine (tun_net_init()) that will be called by register_netdevice(). ndo_init is paired with the desctructor (tun_free_netdev()), so if there\u0027s an error in register_netdevice() the destructor will handle the frees.  BUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security\u002B0x1a/0x20 security/selinux/hooks.c:5605  CPU: 0 PID: 25750 Comm: syz-executor416 Not tainted 5.16.0-rc2-syzk #1 Hardware name: Red Hat KVM, BIOS Call Trace: \u003CTASK\u003E __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl\u002B0x89/0xb5 lib/dump_stack.c:106 print_address_description.constprop.9\u002B0x28/0x160 mm/kasan/report.c:247 kasan_report_invalid_free\u002B0x55/0x80 mm/kasan/report.c:372 ____kasan_slab_free mm/kasan/common.c:346 [inline] __kasan_slab_free\u002B0x107/0x120 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:1723 [inline] slab_free_freelist_hook mm/slub.c:1749 [inline] slab_free mm/slub.c:3513 [inline] kfree\u002B0xac/0x2d0 mm/slub.c:4561 selinux_tun_dev_free_security\u002B0x1a/0x20 security/selinux/hooks.c:5605 security_tun_dev_free_security\u002B0x4f/0x90 security/security.c:2342 tun_free_netdev\u002B0xe6/0x150 drivers/net/tun.c:2215 netdev_run_todo\u002B0x4df/0x840 net/core/dev.c:10627 rtnl_unlock\u002B0x13/0x20 net/core/rtnetlink.c:112 __tun_chr_ioctl\u002B0x80c/0x2870 drivers/net/tun.c:3302 tun_chr_ioctl\u002B0x2f/0x40 drivers/net/tun.c:3311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl\u002B0x19d/0x220 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64\u002B0x3a/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe\u002B0x44/0xae",
  "published": "2024-03-04T18:15:07Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00252,
  "epssPercentile": 0.16743,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.15.15-1",
      "fix": "DEBIAN-CVE-2021-47082",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47082",
      "released": "2024-03-04T18:15:07Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.15.15-1",
      "fix": "DEBIAN-CVE-2021-47082",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47082",
      "released": "2024-03-04T18:15:07Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.15.15-1",
      "fix": "DEBIAN-CVE-2021-47082",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47082",
      "released": "2024-03-04T18:15:07Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}