CVE-2021-47247

A flaw was found in the Linux kernel's Mellanox network driver (net/mlx5e). A race condition during concurrent insertion and deletion of network encapsulation entries in the neighbor update handler can lead to a use-after-free condition. A local attacker could exploit this vulnerability to crash the system, resulting in a Denial of Service (DoS), or potentially achieve arbitrary code execution.

This vulnerability is rated as having a Low impact because triggering the issue requires local administrative privileges (such as CAP_NET_ADMIN) alongside specific Mellanox network adapter hardware. The flaw arises from synchronization issues when offloaded traffic control rules and neighbor encapsulation entries are modified concurrently. Since elevated privileges are already needed to establish the offending network offload configurations, the potential for unauthorized privilege escalation or host denial of service is substantially constrained.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.