{"id":"CVE-2021-47598","state":"PUBLISHED","title":"sch_cake: do not call cake_destroy() from cake_init()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsch_cake: do not call cake_destroy() from cake_init()\n\nqdiscs are not supposed to call their own destroy() method\nfrom init(), because core stack already does that.\n\nsyzbot was able to trigger use after free:\n\nDEBUG_LOCKS_WARN_ON(lock->magic != lock)\nWARNING: CPU: 0 PID: 21902 at kernel/locking/mutex.c:586 __mutex_lock_common kernel/locking/mutex.c:586 [inline]\nWARNING: CPU: 0 PID: 21902 at kernel/locking/mutex.c:586 __mutex_lock+0x9ec/0x12f0 kernel/locking/mutex.c:740\nModules linked in:\nCPU: 0 PID: 21902 Comm: syz-executor189 Not tainted 5.16.0-rc4-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:__mutex_lock_common kernel/locking/mutex.c:586 [inline]\nRIP: 0010:__mutex_lock+0x9ec/0x12f0 kernel/locking/mutex.c:740\nCode: 08 84 d2 0f 85 19 08 00 00 8b 05 97 38 4b 04 85 c0 0f 85 27 f7 ff ff 48 c7 c6 20 00 ac 89 48 c7 c7 a0 fe ab 89 e8 bf 76 ba ff <0f> 0b e9 0d f7 ff ff 48 8b 44 24 40 48 8d b8 c8 08 00 00 48 89 f8\nRSP: 0018:ffffc9000627f290 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: ffff88802315d700 RSI: ffffffff815f1db8 RDI: fffff52000c4fe44\nRBP: ffff88818f28e000 R08: 0000000000000000 R09: 0000000000000000\nR10: ffffffff815ebb5e R11: 0000000000000000 R12: 0000000000000000\nR13: dffffc0000000000 R14: ffffc9000627f458 R15: 0000000093c30000\nFS:  0000555556abc400(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fda689c3303 CR3: 000000001cfbb000 CR4: 0000000000350ef0\nCall Trace:\n <TASK>\n tcf_chain0_head_change_cb_del+0x2e/0x3d0 net/sched/cls_api.c:810\n tcf_block_put_ext net/sched/cls_api.c:1381 [inline]\n tcf_block_put_ext net/sched/cls_api.c:1376 [inline]\n tcf_block_put+0xbc/0x130 net/sched/cls_api.c:1394\n cake_destroy+0x3f/0x80 net/sched/sch_cake.c:2695\n qdisc_create.constprop.0+0x9da/0x10f0 net/sched/sch_api.c:1293\n tc_modify_qdisc+0x4c5/0x1980 net/sched/sch_api.c:1660\n rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5571\n netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2496\n netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]\n netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1345\n netlink_sendmsg+0x904/0xdf0 net/netlink/af_netlink.c:1921\n sock_sendmsg_nosec net/socket.c:704 [inline]\n sock_sendmsg+0xcf/0x120 net/socket.c:724\n ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409\n ___sys_sendmsg+0xf3/0x170 net/socket.c:2463\n __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f1bb06badb9\nCode: Unable to access opcode bytes at RIP 0x7f1bb06bad8f.\nRSP: 002b:00007fff3012a658 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f1bb06badb9\nRDX: 0000000000000000 RSI: 00000000200007c0 RDI: 0000000000000003\nRBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000003\nR10: 0000000000000003 R11: 0000000000000246 R12: 00007fff3012a688\nR13: 00007fff3012a6a0 R14: 00007fff3012a6e0 R15: 00000000000013c2\n </TASK>","publishedAt":"2024-06-19T14:53:59.549Z","updatedAt":"2026-08-05T08:48:31.780Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"046f6fd5daefac7f5abdafb436b30f63bc7c602b","status":"affected","lessThan":"4e388232e630ebe4f94b4a0715ec98c0e2b314a3","versionType":"git"},{"version":"046f6fd5daefac7f5abdafb436b30f63bc7c602b","status":"affected","lessThan":"0d80462fbdcafd536dcad7569e65d3d14a7e9f2f","versionType":"git"},{"version":"046f6fd5daefac7f5abdafb436b30f63bc7c602b","status":"affected","lessThan":"20ad1ef02f9ad5e1dda9eeb113e4c158b4806986","versionType":"git"},{"version":"046f6fd5daefac7f5abdafb436b30f63bc7c602b","status":"affected","lessThan":"f6deae2e2d83bd267e1986f5d71d8c458e18fd99","versionType":"git"},{"version":"046f6fd5daefac7f5abdafb436b30f63bc7c602b","status":"affected","lessThan":"ab443c53916730862cec202078d36fd4008bea79","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/sch_cake.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.19","versionType":"semver"},{"version":"4.19.222","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.168","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.88","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.11","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"5.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/sch_cake.c"]}],"references":["https://git.kernel.org/stable/c/4e388232e630ebe4f94b4a0715ec98c0e2b314a3","https://git.kernel.org/stable/c/0d80462fbdcafd536dcad7569e65d3d14a7e9f2f","https://git.kernel.org/stable/c/20ad1ef02f9ad5e1dda9eeb113e4c158b4806986","https://git.kernel.org/stable/c/f6deae2e2d83bd267e1986f5d71d8c458e18fd99","https://git.kernel.org/stable/c/ab443c53916730862cec202078d36fd4008bea79"],"weaknesses":[],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47598.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47598","state":"PUBLISHED","datePublished":"2024-06-19T14:53:59.549Z","dateUpdated":"2026-08-05T08:48:31.780Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-05-24T15:11:00.734Z"},"containers":{"cna":{"title":"sch_cake: do not call cake_destroy() from cake_init()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsch_cake: do not call cake_destroy() from cake_init()\n\nqdiscs are not supposed to call their own destroy() method\nfrom init(), because core stack already does that.\n\nsyzbot was able to trigger use after free:\n\nDEBUG_LOCKS_WARN_ON(lock->magic != lock)\nWARNING: CPU: 0 PID: 21902 at kernel/locking/mutex.c:586 __mutex_lock_common kernel/locking/mutex.c:586 [inline]\nWARNING: CPU: 0 PID: 21902 at kernel/locking/mutex.c:586 __mutex_lock+0x9ec/0x12f0 kernel/locking/mutex.c:740\nModules linked in:\nCPU: 0 PID: 21902 Comm: syz-executor189 Not tainted 5.16.0-rc4-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:__mutex_lock_common kernel/locking/mutex.c:586 [inline]\nRIP: 0010:__mutex_lock+0x9ec/0x12f0 kernel/locking/mutex.c:740\nCode: 08 84 d2 0f 85 19 08 00 00 8b 05 97 38 4b 04 85 c0 0f 85 27 f7 ff ff 48 c7 c6 20 00 ac 89 48 c7 c7 a0 fe ab 89 e8 bf 76 ba ff <0f> 0b e9 0d f7 ff ff 48 8b 44 24 40 48 8d b8 c8 08 00 00 48 89 f8\nRSP: 0018:ffffc9000627f290 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: ffff88802315d700 RSI: ffffffff815f1db8 RDI: fffff52000c4fe44\nRBP: ffff88818f28e000 R08: 0000000000000000 R09: 0000000000000000\nR10: ffffffff815ebb5e R11: 0000000000000000 R12: 0000000000000000\nR13: dffffc0000000000 R14: ffffc9000627f458 R15: 0000000093c30000\nFS:  0000555556abc400(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fda689c3303 CR3: 000000001cfbb000 CR4: 0000000000350ef0\nCall Trace:\n <TASK>\n tcf_chain0_head_change_cb_del+0x2e/0x3d0 net/sched/cls_api.c:810\n tcf_block_put_ext net/sched/cls_api.c:1381 [inline]\n tcf_block_put_ext net/sched/cls_api.c:1376 [inline]\n tcf_block_put+0xbc/0x130 net/sched/cls_api.c:1394\n cake_destroy+0x3f/0x80 net/sched/sch_cake.c:2695\n qdisc_create.constprop.0+0x9da/0x10f0 net/sched/sch_api.c:1293\n tc_modify_qdisc+0x4c5/0x1980 net/sched/sch_api.c:1660\n rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5571\n netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2496\n netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]\n netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1345\n netlink_sendmsg+0x904/0xdf0 net/netlink/af_netlink.c:1921\n sock_sendmsg_nosec net/socket.c:704 [inline]\n sock_sendmsg+0xcf/0x120 net/socket.c:724\n ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409\n ___sys_sendmsg+0xf3/0x170 net/socket.c:2463\n __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f1bb06badb9\nCode: Unable to access opcode bytes at RIP 0x7f1bb06bad8f.\nRSP: 002b:00007fff3012a658 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f1bb06badb9\nRDX: 0000000000000000 RSI: 00000000200007c0 RDI: 0000000000000003\nRBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000003\nR10: 0000000000000003 R11: 0000000000000246 R12: 00007fff3012a688\nR13: 00007fff3012a6a0 R14: 00007fff3012a6e0 R15: 00000000000013c2\n </TASK>"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"046f6fd5daefac7f5abdafb436b30f63bc7c602b","status":"affected","lessThan":"4e388232e630ebe4f94b4a0715ec98c0e2b314a3","versionType":"git"},{"version":"046f6fd5daefac7f5abdafb436b30f63bc7c602b","status":"affected","lessThan":"0d80462fbdcafd536dcad7569e65d3d14a7e9f2f","versionType":"git"},{"version":"046f6fd5daefac7f5abdafb436b30f63bc7c602b","status":"affected","lessThan":"20ad1ef02f9ad5e1dda9eeb113e4c158b4806986","versionType":"git"},{"version":"046f6fd5daefac7f5abdafb436b30f63bc7c602b","status":"affected","lessThan":"f6deae2e2d83bd267e1986f5d71d8c458e18fd99","versionType":"git"},{"version":"046f6fd5daefac7f5abdafb436b30f63bc7c602b","status":"affected","lessThan":"ab443c53916730862cec202078d36fd4008bea79","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/sch_cake.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.19","versionType":"semver"},{"version":"4.19.222","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.168","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.88","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.11","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"5.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/sch_cake.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/4e388232e630ebe4f94b4a0715ec98c0e2b314a3"},{"url":"https://git.kernel.org/stable/c/0d80462fbdcafd536dcad7569e65d3d14a7e9f2f"},{"url":"https://git.kernel.org/stable/c/20ad1ef02f9ad5e1dda9eeb113e4c158b4806986"},{"url":"https://git.kernel.org/stable/c/f6deae2e2d83bd267e1986f5d71d8c458e18fd99"},{"url":"https://git.kernel.org/stable/c/ab443c53916730862cec202078d36fd4008bea79"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Triggered via local netlink RTM_NEWQDISC (tc qdisc add ... cake) through sendmsg → rtnetlink → tc_modify_qdisc → qdisc_create → cake_init; not reachable from remote packet processing.\nAC:L - The attacker can reliably force the ENOMEM path by exhausting memory before creating the cake qdisc; the ~700KB+ kvcalloc is large and easy to fail under attacker-controlled memory pressure, with no race or other condition outside their control.\nPR:L - Creating a qdisc requires CAP_NET_ADMIN checked via netlink_net_capable against the network namespace's user_ns, which an unprivileged user obtains through user+net namespaces (e.g. unshare -Urn) and attaching cake to lo.\nUI:N - The attacker triggers the bug entirely with their own netlink messages; no victim action is required.\nS:U - This is a standard in-kernel UAF/privilege-escalation path within the same kernel security authority; it does not cross VM, IOMMU, or other security boundaries.\nC:H - Double-free/UAF of the heap-allocated tcf_block allows reclaim and controlled reads of the freed object, enabling arbitrary kernel information disclosure.\nI:H - The same UAF/double-free of tcf_block enables heap spraying and corruption of the reclaimed object (including function pointers/callbacks), supporting arbitrary write and control-flow hijacking.\nA:H - The UAF reliably causes kernel warnings/oopses (as seen in the syzbot report locking a freed mutex) and can panic or hang the system."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T08:48:31.780Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"4.19.222"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"5.4.168"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"5.10.88"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"5.15.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"5.16"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/4e388232e630ebe4f94b4a0715ec98c0e2b314a3","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/0d80462fbdcafd536dcad7569e65d3d14a7e9f2f","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/20ad1ef02f9ad5e1dda9eeb113e4c158b4806986","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/f6deae2e2d83bd267e1986f5d71d8c458e18fd99","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/ab443c53916730862cec202078d36fd4008bea79","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T05:47:39.567Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-47598","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T17:12:20.720513Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-11T17:34:51.903Z"}}]}}}