CVE-2021-46948 (GCVE-0-2021-46948)

Vulnerability from cvelistv5 – Published: 2024-02-27 18:40 – Updated: 2026-08-05 08:45
VLAI
Title
sfc: farch: fix TX queue lookup in TX event handling
Summary
In the Linux kernel, the following vulnerability has been resolved: sfc: farch: fix TX queue lookup in TX event handling We're starting from a TXQ label, not a TXQ type, so efx_channel_get_tx_queue() is inappropriate (and could return NULL, leading to panics).
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-03-11 16:39 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 12804793b17c0e19115a90d98f2f3df0cb79e233 , < bf2b941d0a6f2d3b9f5fa3c4c21bdd54f71ce253 (git)
Affected: 12804793b17c0e19115a90d98f2f3df0cb79e233 , < 35c7a83ad1bb1d48ae249346e61b1132bcbf9052 (git)
Affected: 12804793b17c0e19115a90d98f2f3df0cb79e233 , < e531db1ea6f98c9612cb2de093a107c7eadfb96c (git)
Affected: 12804793b17c0e19115a90d98f2f3df0cb79e233 , < 83b09a1807415608b387c7bc748d329fefc5617e (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.10.36 , ≤ 5.10.* (semver)
Unaffected: 5.11.20 , ≤ 5.11.* (semver)
Unaffected: 5.12.3 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-46948",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-11T16:39:46.469007Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:22:13.138Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:17:43.029Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bf2b941d0a6f2d3b9f5fa3c4c21bdd54f71ce253"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/35c7a83ad1bb1d48ae249346e61b1132bcbf9052"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e531db1ea6f98c9612cb2de093a107c7eadfb96c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/83b09a1807415608b387c7bc748d329fefc5617e"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/sfc/farch.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bf2b941d0a6f2d3b9f5fa3c4c21bdd54f71ce253",
              "status": "affected",
              "version": "12804793b17c0e19115a90d98f2f3df0cb79e233",
              "versionType": "git"
            },
            {
              "lessThan": "35c7a83ad1bb1d48ae249346e61b1132bcbf9052",
              "status": "affected",
              "version": "12804793b17c0e19115a90d98f2f3df0cb79e233",
              "versionType": "git"
            },
            {
              "lessThan": "e531db1ea6f98c9612cb2de093a107c7eadfb96c",
              "status": "affected",
              "version": "12804793b17c0e19115a90d98f2f3df0cb79e233",
              "versionType": "git"
            },
            {
              "lessThan": "83b09a1807415608b387c7bc748d329fefc5617e",
              "status": "affected",
              "version": "12804793b17c0e19115a90d98f2f3df0cb79e233",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/sfc/farch.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.11.*",
              "status": "unaffected",
              "version": "5.11.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.36",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.20",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.3",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsfc: farch: fix TX queue lookup in TX event handling\n\nWe\u0027re starting from a TXQ label, not a TXQ type, so\n efx_channel_get_tx_queue() is inappropriate (and could return NULL,\n leading to panics)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On Siena/farch, TX completions for queue labels 2\u20133 (HIGHPRI TC or XDP_TX/REDIRECT queues) hit the buggy lookup. A remote peer can drive that path by sending traffic that is XDP-redirected/TX\u2019d or QoS-classified onto HIGHPRI TX queues on a host using this NIC.\nAC:L - The attacker only needs to generate traffic that completes on those TX queues; RSS/XDP CPU mapping makes hitting labels 2\u20133 reliable under load, with no race or unpredictable hardware state required.\nPR:N - In the highest-impact deployments (XDP_TX/REDIRECT or TC/mqprio HIGHPRI already configured on the Solarflare interface), an unauthenticated network peer can trigger the panic without any local account or capabilities.\nUI:N - Exploitation requires no victim user action beyond the host already running the affected driver configuration; packet delivery alone drives the TX completion path.\nS:U - Impact is a kernel oops/panic in the host OS networking authority; it does not cross into a different security domain such as a guest-to-host or IOMMU boundary.\nC:N - The failure is a NULL pointer dereference in efx_xmit_done with no out-of-bounds read or UAF, so it does not disclose memory contents.\nI:N - tx_queue_by_type[2/3] is NULL, so the crash is a pure NULL deref with no attacker-controlled write or corruptible object to hijack control flow.\nA:H - Dereferencing the NULL tx_queue in efx_xmit_done causes a kernel oops/panic, fully disrupting system availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:45:11.702Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bf2b941d0a6f2d3b9f5fa3c4c21bdd54f71ce253"
        },
        {
          "url": "https://git.kernel.org/stable/c/35c7a83ad1bb1d48ae249346e61b1132bcbf9052"
        },
        {
          "url": "https://git.kernel.org/stable/c/e531db1ea6f98c9612cb2de093a107c7eadfb96c"
        },
        {
          "url": "https://git.kernel.org/stable/c/83b09a1807415608b387c7bc748d329fefc5617e"
        }
      ],
      "title": "sfc: farch: fix TX queue lookup in TX event handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-46948",
    "datePublished": "2024-02-27T18:40:32.895Z",
    "dateReserved": "2024-02-25T13:45:52.722Z",
    "dateUpdated": "2026-08-05T08:45:11.702Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-46948",
      "date": "2026-09-29",
      "epss": "0.00596",
      "percentile": "0.46367"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/sfc/farch.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "bf2b941d0a6f2d3b9f5fa3c4c21bdd54f71ce253",
                    "status": "affected",
                    "version": "12804793b17c0e19115a90d98f2f3df0cb79e233",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "35c7a83ad1bb1d48ae249346e61b1132bcbf9052",
                    "status": "affected",
                    "version": "12804793b17c0e19115a90d98f2f3df0cb79e233",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e531db1ea6f98c9612cb2de093a107c7eadfb96c",
                    "status": "affected",
                    "version": "12804793b17c0e19115a90d98f2f3df0cb79e233",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "83b09a1807415608b387c7bc748d329fefc5617e",
                    "status": "affected",
                    "version": "12804793b17c0e19115a90d98f2f3df0cb79e233",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/sfc/farch.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.10"
                  },
                  {
                    "lessThan": "5.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.36",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.11.*",
                    "status": "unaffected",
                    "version": "5.11.20",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.12.*",
                    "status": "unaffected",
                    "version": "5.12.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.13",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4E778606-3A80-42DD-996C-5570B1192986",
                    "versionEndExcluding": "5.10.36",
                    "versionStartIncluding": "5.10.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EFB425F0-C28C-4B44-8B4C-AD512AA832DE",
                    "versionEndExcluding": "5.11.20",
                    "versionStartIncluding": "5.11.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C3814FA3-8141-4313-A852-8C4212BE12AD",
                    "versionEndExcluding": "5.12.3",
                    "versionStartIncluding": "5.12.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsfc: farch: fix TX queue lookup in TX event handling\n\nWe\u0027re starting from a TXQ label, not a TXQ type, so\n efx_channel_get_tx_queue() is inappropriate (and could return NULL,\n leading to panics)."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: sfc: farch: corrige la b\u00fasqueda de cola TX en el manejo de eventos TX Estamos comenzando desde una etiqueta TXQ, no un tipo TXQ, por lo que efx_channel_get_tx_queue() es inapropiado (y podr\u00eda devolver NULL, provocando p\u00e1nico)."
          }
        ],
        "id": "CVE-2021-46948",
        "lastModified": "2026-08-04T10:16:37.837",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-46948",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-11T16:39:46.469007Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-02-27T19:04:06.330",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/35c7a83ad1bb1d48ae249346e61b1132bcbf9052"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/83b09a1807415608b387c7bc748d329fefc5617e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bf2b941d0a6f2d3b9f5fa3c4c21bdd54f71ce253"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e531db1ea6f98c9612cb2de093a107c7eadfb96c"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/35c7a83ad1bb1d48ae249346e61b1132bcbf9052"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/83b09a1807415608b387c7bc748d329fefc5617e"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bf2b941d0a6f2d3b9f5fa3c4c21bdd54f71ce253"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e531db1ea6f98c9612cb2de093a107c7eadfb96c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:10:54+00:00",
      "cve": "CVE-2021-46948",
      "id": "CVE-2021-46948",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sfc: farch: fix TX queue lookup in TX event handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-46948.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:17:43.029Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/bf2b941d0a6f2d3b9f5fa3c4c21bdd54f71ce253"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/35c7a83ad1bb1d48ae249346e61b1132bcbf9052"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/e531db1ea6f98c9612cb2de093a107c7eadfb96c"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/83b09a1807415608b387c7bc748d329fefc5617e"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-46948",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-03-11T16:39:46.469007Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-07-05T15:20:41.602Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/sfc/farch.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "bf2b941d0a6f2d3b9f5fa3c4c21bdd54f71ce253",
                  "status": "affected",
                  "version": "12804793b17c0e19115a90d98f2f3df0cb79e233",
                  "versionType": "git"
                },
                {
                  "lessThan": "35c7a83ad1bb1d48ae249346e61b1132bcbf9052",
                  "status": "affected",
                  "version": "12804793b17c0e19115a90d98f2f3df0cb79e233",
                  "versionType": "git"
                },
                {
                  "lessThan": "e531db1ea6f98c9612cb2de093a107c7eadfb96c",
                  "status": "affected",
                  "version": "12804793b17c0e19115a90d98f2f3df0cb79e233",
                  "versionType": "git"
                },
                {
                  "lessThan": "83b09a1807415608b387c7bc748d329fefc5617e",
                  "status": "affected",
                  "version": "12804793b17c0e19115a90d98f2f3df0cb79e233",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/sfc/farch.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.10"
                },
                {
                  "lessThan": "5.10",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.36",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.11.*",
                  "status": "unaffected",
                  "version": "5.11.20",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.12.*",
                  "status": "unaffected",
                  "version": "5.12.3",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.13",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.36",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.11.20",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.12.3",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.13",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsfc: farch: fix TX queue lookup in TX event handling\n\nWe\u0027re starting from a TXQ label, not a TXQ type, so\n efx_channel_get_tx_queue() is inappropriate (and could return NULL,\n leading to panics)."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - On Siena/farch, TX completions for queue labels 2\u20133 (HIGHPRI TC or XDP_TX/REDIRECT queues) hit the buggy lookup. A remote peer can drive that path by sending traffic that is XDP-redirected/TX\u2019d or QoS-classified onto HIGHPRI TX queues on a host using this NIC.\nAC:L - The attacker only needs to generate traffic that completes on those TX queues; RSS/XDP CPU mapping makes hitting labels 2\u20133 reliable under load, with no race or unpredictable hardware state required.\nPR:N - In the highest-impact deployments (XDP_TX/REDIRECT or TC/mqprio HIGHPRI already configured on the Solarflare interface), an unauthenticated network peer can trigger the panic without any local account or capabilities.\nUI:N - Exploitation requires no victim user action beyond the host already running the affected driver configuration; packet delivery alone drives the TX completion path.\nS:U - Impact is a kernel oops/panic in the host OS networking authority; it does not cross into a different security domain such as a guest-to-host or IOMMU boundary.\nC:N - The failure is a NULL pointer dereference in efx_xmit_done with no out-of-bounds read or UAF, so it does not disclose memory contents.\nI:N - tx_queue_by_type[2/3] is NULL, so the crash is a pure NULL deref with no attacker-controlled write or corruptible object to hijack control flow.\nA:H - Dereferencing the NULL tx_queue in efx_xmit_done causes a kernel oops/panic, fully disrupting system availability."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:45:11.702Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/bf2b941d0a6f2d3b9f5fa3c4c21bdd54f71ce253"
            },
            {
              "url": "https://git.kernel.org/stable/c/35c7a83ad1bb1d48ae249346e61b1132bcbf9052"
            },
            {
              "url": "https://git.kernel.org/stable/c/e531db1ea6f98c9612cb2de093a107c7eadfb96c"
            },
            {
              "url": "https://git.kernel.org/stable/c/83b09a1807415608b387c7bc748d329fefc5617e"
            }
          ],
          "title": "sfc: farch: fix TX queue lookup in TX event handling",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-46948",
        "datePublished": "2024-02-27T18:40:32.895Z",
        "dateReserved": "2024-02-25T13:45:52.722Z",
        "dateUpdated": "2026-08-05T08:45:11.702Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.