CVE-2021-47141
kernel: gve: Add NULL pointer checks when freeing irqs.
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · March 25, 2024
Updated · October 1, 2026
Description
A vulnerability was found in the Generic Virtual Ethernet (gve) driver in the Linux kernel. A NULL pointer dereference could occur during the freeing of notification blocks. This issue arises when attempting to index priv->msix_vectors without prior allocation, potentially leading to a crash if the driver is unloaded.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
To mitigate this issue, NULL pointer checks have been added to ensure safe handling during the freeing process of notification blocks within the gve driver. It is advised to update the affected package as soon as possible.
CVSS / CWE
CVSS 3.1 · 4.4CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-476 · NULL Pointer Dereference