CVE-2021-47137
A flaw in the Linux kernel’s Lantiq network driver can corrupt memory when a packet’s receive descriptor is set up with an invalid address. The issue has been fixed in a kernel patch. Users should update to a kernel version that includes the fix.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, especially versions 5.13 and earlier that use the Lantiq driver.
Real-world impact
If exploited, an attacker could corrupt memory, potentially leading to arbitrary code execution or a system crash.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited remotely without authentication, with no user interaction, and can fully compromise confidentiality, integrity, and availability.
What to do about it
- 011. Update your Linux kernel to a version that includes the CVE-2021-47137 fix.
- 022. Reboot the system to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- Mar 25, 2024 · Mar 25, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 22h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.