CVE-2021-47441

A flaw was found in the Linux kernel's Mellanox switch (mlxsw) thermal driver. A privileged local user could trigger a Denial of Service (DoS) or kernel information disclosure by configuring a cooling state value that exceeds the maximum supported limit. Because the driver fails to validate this upper boundary, thermal statistics tracking performs an out-of-bounds memory read, leading to a system crash.

This vulnerability is rated as having a Low impact because exploitation requires administrative privileges and the presence of specialized Mellanox switch hardware. Modifying cooling states through the sysfs thermal interface is restricted to privileged users who already possess system-level control. Consequently, the flaw presents minimal additional risk in typical deployments where unprivileged users cannot access thermal device parameters.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.