Read the docs
TI-2021-22056 Aliases CVE-2021-47400GHSA-wr76-p7r7-8vjv

net: hns3: do not allow call hns3_nic_net_open repeatedly

Priority LOW 34Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 10 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

In the Linux kernel, the following vulnerability has been resolved: net: hns3: do not allow call hns3_nic_net_open repeatedly hns3_nic_net_open() is not allowed to called repeatly, but there is no checking for this. When doing device reset and setup tc concurrently, there is a small oppotunity to call hns3_nic_net_open repeatedly, and cause kernel bug by calling napi_enable twice. The calltrace information is like below: [ 3078.222780] ------------[ cut here ]------------ [ 3078.230255] kernel BUG at net/core/dev.c:6991! [ 3078.236224] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 3078.243431] Modules linked in: hns3 hclgevf hclge hnae3 vfio_iommu_type1 vfio_pci vfio_virqfd vfio pv680_mii(O) [ 3078.258880] CPU: 0 PID: 295 Comm: kworker/u8:5 Tainted: G O 5.14.0-rc4+ #1 [ 3078.269102] Hardware name: , BIOS KpxxxFPGA 1P B600 V181 08/12/2021 [ 3078.276801] Workqueue: hclge hclge_service_task [hclge] [ 3078.288774] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--) [ 3078.296168] pc : napi_enable+0x80/0x84 tc qdisc sho[w 3d0e7v8 .e3t0h218 79] lr : hns3_nic_net_open+0x138/0x510 [hns3] [ 3078.314771] sp : ffff8000108abb20 [ 3078.319099] x29: ffff8000108abb20 x28: 0000000000000000 x27: ffff0820a8490300 [ 3078.329121] x26: 0000000000000001 x25: ffff08209cfc6200 x24: 0000000000000000 [ 3078.339044] x23: ffff0820a8490300 x22: ffff08209cd76000 x21: ffff0820abfe3880 [ 3078.349018] x20: 0000000000000000 x19: ffff08209cd76900 x18: 0000000000000000 [ 3078.358620] x17: 0000000000000000 x16: ffffc816e1727a50 x15: 0000ffff8f4ff930 [ 3078.368895] x14: 0000000000000000 x13: 0000000000000000 x12: 0000259e9dbeb6b4 [ 3078.377987] x11: 0096a8f7e764eb40 x10: 634615ad28d3eab5 x9 : ffffc816ad8885b8 [ 3078.387091] x8 : ffff08209cfc6fb8 x7 : ffff0820ac0da058 x6 : ffff0820a8490344 [ 3078.396356] x5 : 0000000000000140 x4 : 0000000000000003 x3 : ffff08209cd76938 [ 3078.405365] x2 : 0000000000000000 x1 : 0000000000000010 x0 : ffff0820abfe38a0 [ 3078.414657] Call trace: [ 3078.418517] napi_enable+0x80/0x84 [ 3078.424626] hns3_reset_notify_up_enet+0x78/0xd0 [hns3] [ 3078.433469] hns3_reset_notify+0x64/0x80 [hns3] [ 3078.441430] hclge_notify_client+0x68/0xb0 [hclge] [ 3078.450511] hclge_reset_rebuild+0x524/0x884 [hclge] [ 3078.458879] hclge_reset_service_task+0x3c4/0x680 [hclge] [ 3078.467470] hclge_service_task+0xb0/0xb54 [hclge] [ 3078.475675] process_one_work+0x1dc/0x48c [ 3078.481888] worker_thread+0x15c/0x464 [ 3078.487104] kthread+0x160/0x170 [ 3078.492479] ret_from_fork+0x10/0x18 [ 3078.498785] Code: c8027c81 35ffffa2 d50323bf d65f03c0 (d4210000) [ 3078.506889] ---[ end trace 8ebe0340a1b0fb44 ]--- Once hns3_nic_net_open() is excute success, the flag HNS3_NIC_STATE_DOWN will be cleared. So add checking for this flag, directly return when HNS3_NIC_STATE_DOWN is no set.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00256 17th percentileScored 2026-11-07
Fix Partial Linux (Linux): 5.4.151, 5.10.71, 5.14.10 +1Red Hat: 3 advisoriesRed Hat: 10 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux5.0 and later5.4.151, 5.10.71, 5.14.10, 5.15Patch availableCNA
  • Linux VendorLinux Affected 5.0 and later Fixed in 5.4.151, 5.10.71, 5.14.10, 5.15 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*5.0 to before 5.4.151; 5.5 to before 5.10.71; 5.11 to before 5.14.10VulnerableLinux
cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*5.15 rc1VulnerableLinux
cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*5.15 rc2VulnerableLinux
cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*5.15 rc3VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 5.0 to before 5.4.151; 5.5 to before 5.10.71; 5.11 to before 5.14.10 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:* Versions 5.15 rc1 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:* Versions 5.15 rc2 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:* Versions 5.15 rc3 Vulnerable ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 5.4.151, 5.10.71, 5.14.10, 5.15

Red Hat 3 advisories

  • RHSA-2024:4349 Released 2024-07-08 · Red Hat rating Moderate
    kernel security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-427.24.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.24.1.el9_4, kernel-64k-devel-5.14.0-427.24.1.el9_4 +11
    • Red Hat Enterprise Linux BaseOS (v. 9) bpftool-7.3.0-427.24.1.el9_4, kernel-5.14.0-427.24.1.el9_4, kernel-64k-5.14.0-427.24.1.el9_4 +29
    • Red Hat Enterprise Linux CRB (v. 9) kernel-tools-libs-devel-5.14.0-427.24.1.el9_4, libperf-5.14.0-427.24.1.el9_4
    • Red Hat Enterprise Linux NFV (v. 9) kernel-rt-5.14.0-427.24.1.el9_4, kernel-rt-core-5.14.0-427.24.1.el9_4, kernel-rt-debug-5.14.0-427.24.1.el9_4 +11
    • Red Hat Enterprise Linux RT (v. 9) kernel-rt-5.14.0-427.24.1.el9_4, kernel-rt-core-5.14.0-427.24.1.el9_4, kernel-rt-debug-5.14.0-427.24.1.el9_4 +9
  • RHSA-2024:4108 Released 2024-06-26 · Red Hat rating Important
    kernel security and bug fix update
    • Red Hat CodeReady Linux Builder EUS (v.9.2) kernel-tools-libs-devel-5.14.0-284.71.1.el9_2
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) kernel-64k-debug-devel-5.14.0-284.71.1.el9_2, kernel-64k-debug-devel-matched-5.14.0-284.71.1.el9_2, kernel-64k-devel-5.14.0-284.71.1.el9_2 +10
    • Red Hat Enterprise Linux BaseOS EUS (v.9.2) bpftool-7.0.0-284.71.1.el9_2, kernel-5.14.0-284.71.1.el9_2, kernel-64k-5.14.0-284.71.1.el9_2 +29
  • RHSA-2024:4106 Released 2024-06-26 · Red Hat rating Important
    kernel-rt security update
    • Red Hat Enterprise Linux Real Time EUS (v.9.2) kernel-rt-5.14.0-284.71.1.rt14.356.el9_2, kernel-rt-core-5.14.0-284.71.1.rt14.356.el9_2, kernel-rt-debug-5.14.0-284.71.1.rt14.356.el9_2 +9
    • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.2) kernel-rt-5.14.0-284.71.1.rt14.356.el9_2, kernel-rt-core-5.14.0-284.71.1.rt14.356.el9_2, kernel-rt-debug-5.14.0-284.71.1.rt14.356.el9_2 +11

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat CodeReady Linux Builder EUS (v.9.2)Fixed RHSA-2024:4108
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:4349
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:4108
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2024:4349
Red Hat Enterprise Linux BaseOS EUS (v.9.2)Fixed RHSA-2024:4108
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2024:4349
Red Hat Enterprise Linux NFV (v. 9)Fixed RHSA-2024:4349
Red Hat Enterprise Linux RT (v. 9)Fixed RHSA-2024:4349
Red Hat Enterprise Linux Real Time EUS (v.9.2)Fixed RHSA-2024:4106
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.2)Fixed RHSA-2024:4106
Not affected: 4 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux AppStream EUS (v.9.2)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-47400
  2. 2026-10-03 Alias added: GHSA-wr76-p7r7-8vjv

References

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources