# CVE-2021-47136: linux: In the Linux kernel, the following vulnerability has been resolved:  net: zero-initialize tc skb extension on allocat...

CVE-2021-47136 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47136, released March 25, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2021-47136
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0054
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 25, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  net: zero-initialize tc skb extension on allocation  Function skb_ext_add() doesn't initialize created skb extension with any value and leaves it up to the user. However, since extension of type TC_SKB_EXT originally contained only single value tc_skb_ext->chain its users used to just assign the chain value without setting whole extension memory to zero first. This assumption changed when TC_SKB_EXT extension was extended with additional fields but not all users were updated to initialize the new fields which leads to use of uninitialized memory afterwards. UBSAN log:  [  778.299821] UBSAN: invalid-load in net/openvswitch/flow.c:899:28 [  778.301495] load of value 107 is not a valid value for type '_Bool' [  778.303215] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.12.0-rc7+ #2 [  778.304933] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [  778.307901] Call Trace: [  778.308680]  <IRQ> [  778.309358]  dump_stack+0xbb/0x107 [  778.310307]  ubsan_epilogue+0x5/0x40 [  778.311167]  __ubsan_handle_load_invalid_value.cold+0x43/0x48 [  778.312454]  ? memset+0x20/0x40 [  778.313230]  ovs_flow_key_extract.cold+0xf/0x14 [openvswitch] [  778.314532]  ovs_vport_receive+0x19e/0x2e0 [openvswitch] [  778.315749]  ? ovs_vport_find_upcall_portid+0x330/0x330 [openvswitch] [  778.317188]  ? create_prof_cpu_mask+0x20/0x20 [  778.318220]  ? arch_stack_walk+0x82/0xf0 [  778.319153]  ? secondary_startup_64_no_verify+0xb0/0xbb [  778.320399]  ? stack_trace_save+0x91/0xc0 [  778.321362]  ? stack_trace_consume_entry+0x160/0x160 [  778.322517]  ? lock_release+0x52e/0x760 [  778.323444]  netdev_frame_hook+0x323/0x610 [openvswitch] [  778.324668]  ? ovs_netdev_get_vport+0xe0/0xe0 [openvswitch] [  778.325950]  __netif_receive_skb_core+0x771/0x2db0 [  778.327067]  ? lock_downgrade+0x6e0/0x6f0 [  778.328021]  ? lock_acquire+0x565/0x720 [  778.328940]  ? generic_xdp_tx+0x4f0/0x4f0 [  778.329902]  ? inet_gro_receive+0x2a7/0x10a0 [  778.330914]  ? lock_downgrade+0x6f0/0x6f0 [  778.331867]  ? udp4_gro_receive+0x4c4/0x13e0 [  778.332876]  ? lock_release+0x52e/0x760 [  778.333808]  ? dev_gro_receive+0xcc8/0x2380 [  778.334810]  ? lock_downgrade+0x6f0/0x6f0 [  778.335769]  __netif_receive_skb_list_core+0x295/0x820 [  778.336955]  ? process_backlog+0x780/0x780 [  778.337941]  ? mlx5e_rep_tc_netdevice_event_unregister+0x20/0x20 [mlx5_core] [  778.339613]  ? seqcount_lockdep_reader_access.constprop.0+0xa7/0xc0 [  778.341033]  ? kvm_clock_get_cycles+0x14/0x20 [  778.342072]  netif_receive_skb_list_internal+0x5f5/0xcb0 [  778.343288]  ? __kasan_kmalloc+0x7a/0x90 [  778.344234]  ? mlx5e_handle_rx_cqe_mpwrq+0x9e0/0x9e0 [mlx5_core] [  778.345676]  ? mlx5e_xmit_xdp_frame_mpwqe+0x14d0/0x14d0 [mlx5_core] [  778.347140]  ? __netif_receive_skb_list_core+0x820/0x820 [  778.348351]  ? mlx5e_post_rx_mpwqes+0xa6/0x25d0 [mlx5_core] [  778.349688]  ? napi_gro_flush+0x26c/0x3c0 [  778.350641]  napi_complete_done+0x188/0x6b0 [  778.351627]  mlx5e_napi_poll+0x373/0x1b80 [mlx5_core] [  778.352853]  __napi_poll+0x9f/0x510 [  778.353704]  ? mlx5_flow_namespace_set_mode+0x260/0x260 [mlx5_core] [  778.355158]  net_rx_action+0x34c/0xa40 [  778.356060]  ? napi_threaded_poll+0x3d0/0x3d0 [  778.357083]  ? sched_clock_cpu+0x18/0x190 [  778.358041]  ? __common_interrupt+0x8e/0x1a0 [  778.359045]  __do_softirq+0x1ce/0x984 [  778.359938]  __irq_exit_rcu+0x137/0x1d0 [  778.360865]  irq_exit_rcu+0xa/0x20 [  778.361708]  common_interrupt+0x80/0xa0 [  778.362640]  </IRQ> [  778.363212]  asm_common_interrupt+0x1e/0x40 [  778.364204] RIP: 0010:native_safe_halt+0xe/0x10 [  778.365273] Code: 4f ff ff ff 4c 89 e7 e8 50 3f 40 fe e9 dc fe ff ff 48 89 df e8 43 3f 40 fe eb 90 cc e9 07 00 00 00 0f 00 2d 74 05 62 00 fb f4 <c3> 90 e9 07 00 00 00 0f 00 2d 64 05 62 00 f4 c3 cc cc 0f 1f 44 00 [  778.369355] RSP: 0018:ffffffff84407e48 EFLAGS: 00000246 [  778.370570] RAX ---truncated---

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 5.14.6-1 | [DEBIAN-CVE-2021-47136](https://patchblox.com/security/data/fix/linux/debian-cve-2021-47136.md) | Mar 25, 2024 |
| Linux | linux Debian 13.5 (trixie) | 5.14.6-1 | [DEBIAN-CVE-2021-47136](https://patchblox.com/security/data/fix/linux/debian-cve-2021-47136.md) | Mar 25, 2024 |
| Linux | linux Debian 14 | 5.14.6-1 | [DEBIAN-CVE-2021-47136](https://patchblox.com/security/data/fix/linux/debian-cve-2021-47136.md) | Mar 25, 2024 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.