{"id":"CVE-2021-47367","state":"PUBLISHED","title":"virtio-net: fix pages leaking when building skb in big mode","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix pages leaking when building skb in big mode\n\nWe try to use build_skb() if we had sufficient tailroom. But we forget\nto release the unused pages chained via private in big mode which will\nleak pages. Fixing this by release the pages after building the skb in\nbig mode.","publishedAt":"2024-05-21T15:03:33.861Z","updatedAt":"2026-05-11T13:53:20.233Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"CISA-ADP"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"fb32856b16ad9d5bcd75b76a274e2c515ac7b9d7","status":"affected","lessThan":"f020bb63b5d2e5576acadd10e158fe3b04af67ba","versionType":"git"},{"version":"fb32856b16ad9d5bcd75b76a274e2c515ac7b9d7","status":"affected","lessThan":"afd92d82c9d715fb97565408755acad81573591a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/virtio_net.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.13","versionType":"semver"},{"version":"5.14.9","status":"unaffected","lessThanOrEqual":"5.14.*","versionType":"semver"},{"version":"5.15","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/virtio_net.c"]}],"references":["https://git.kernel.org/stable/c/f020bb63b5d2e5576acadd10e158fe3b04af67ba","https://git.kernel.org/stable/c/afd92d82c9d715fb97565408755acad81573591a"],"weaknesses":["CWE-119"],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47367.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47367","state":"PUBLISHED","datePublished":"2024-05-21T15:03:33.861Z","dateUpdated":"2026-05-11T13:53:20.233Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-05-21T14:58:30.810Z"},"containers":{"cna":{"title":"virtio-net: fix pages leaking when building skb in big mode","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix pages leaking when building skb in big mode\n\nWe try to use build_skb() if we had sufficient tailroom. But we forget\nto release the unused pages chained via private in big mode which will\nleak pages. Fixing this by release the pages after building the skb in\nbig mode."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"fb32856b16ad9d5bcd75b76a274e2c515ac7b9d7","status":"affected","lessThan":"f020bb63b5d2e5576acadd10e158fe3b04af67ba","versionType":"git"},{"version":"fb32856b16ad9d5bcd75b76a274e2c515ac7b9d7","status":"affected","lessThan":"afd92d82c9d715fb97565408755acad81573591a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/virtio_net.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.13","versionType":"semver"},{"version":"5.14.9","status":"unaffected","lessThanOrEqual":"5.14.*","versionType":"semver"},{"version":"5.15","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/virtio_net.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/f020bb63b5d2e5576acadd10e158fe3b04af67ba"},{"url":"https://git.kernel.org/stable/c/afd92d82c9d715fb97565408755acad81573591a"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T13:53:20.233Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"5.14.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"5.15"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"5.13","status":"affected"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"fb32856b16ad","status":"affected","lessThan":"f020bb63b5d2","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"fb32856b16ad","status":"affected","lessThan":"afd92d82c9d7","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"0","status":"unaffected","lessThan":"5.13","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"5.15","status":"unaffected"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"5.14.9","status":"unaffected","lessThanOrEqual":"5.15","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-06-06T15:00:03.181537Z","id":"CVE-2021-47367","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-119","type":"CWE","lang":"en","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-06T15:30:00.591Z"}},{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/f020bb63b5d2e5576acadd10e158fe3b04af67ba","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/afd92d82c9d715fb97565408755acad81573591a","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T05:32:08.538Z"}}]}}}