CVE-2021-47197
kernel: net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · April 10, 2024
Updated · October 30, 2026
Description
A flaw was found in the Linux kernel's Mellanox network driver (mlx5). This issue allows a local user to cause a Denial of Service (DoS) by triggering a kernel crash. The vulnerability occurs when a completion queue destruction fails, leaving an uncleared debug pointer that is improperly referenced during subsequent cleanup operations.
Statement
This vulnerability is rated as Low impact because it requires local access on systems equipped with Mellanox hardware and only leads to a denial of service. The issue manifests during an uncommon error path where a completion queue fails to terminate properly, resulting in a kernel panic upon subsequent teardown attempts. Typical Red Hat Enterprise Linux environments not utilizing Mellanox network controllers or InfiniBand devices remain unaffected by this flaw.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 4.4CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-158 · Improper Neutralization of Null Byte or NUL Character