{
  "cveId": "CVE-2021-47555",
  "url": "https://patchblox.com/security/cve/CVE-2021-47555",
  "summary": "CVE-2021-47555 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47555, released May 24, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  net: vlan: fix underflow for the real_dev refcnt...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  net: vlan: fix underflow for the real_dev refcnt  Inject error before dev_hold(real_dev) in register_vlan_dev(), and execute the following testcase:  ip link add dev dummy1 type dummy ip link add name dummy1.100 link dummy1 type vlan id 100 ip link del dev dummy1  When the dummy netdevice is removed, we will get a WARNING as following:  ======================================================================= refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 2 PID: 0 at lib/refcount.c:31 refcount_warn_saturate\u002B0xbf/0x1e0  and an endless loop of:  ======================================================================= unregister_netdevice: waiting for dummy1 to become free. Usage count = -1073741824  That is because dev_put(real_dev) in vlan_dev_free() be called without dev_hold(real_dev) in register_vlan_dev(). It makes the refcnt of real_dev underflow.  Move the dev_hold(real_dev) to vlan_dev_init() which is the call-back of ndo_init(). That makes dev_hold() and dev_put() for vlan\u0027s real_dev symmetrical.",
  "published": "2024-05-24T15:15:20Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00221,
  "epssPercentile": 0.1271,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.15.15-1",
      "fix": "DEBIAN-CVE-2021-47555",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47555",
      "released": "2024-05-24T15:15:20Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.15.15-1",
      "fix": "DEBIAN-CVE-2021-47555",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47555",
      "released": "2024-05-24T15:15:20Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.15.15-1",
      "fix": "DEBIAN-CVE-2021-47555",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47555",
      "released": "2024-05-24T15:15:20Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}