CVE-2021-47309

A vulnerability was found in the Linux kernel's networking component, where the skb_tunnel_info() function can return unvalidated data. This issue arises because the function does not check the type of lwtstate->data before using it, which could lead to accessing incompatible data types and cause memory errors.

This vulnerability is rated as a Moderate severity because the unvalidated data is accessed and it may lead to out-of-bounds memory reads, which could result in system crashes or unexpected behavior.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.