{"api_version":"1","generated_at":"2026-08-09T07:24:55+00:00","cve":"CVE-2021-46955","urls":{"html":"https://cve.report/CVE-2021-46955","api":"https://cve.report/api/cve/CVE-2021-46955.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-46955","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-46955"},"summary":{"title":"openvswitch: fix stack OOB read while fragmenting IPv4 packets","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: fix stack OOB read while fragmenting IPv4 packets\n\nrunning openvswitch on kernels built with KASAN, it's possible to see the\nfollowing splat while testing fragmentation of IPv4 packets:\n\n BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60\n Read of size 1 at addr ffff888112fc713c by task handler2/1367\n\n CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+ #418\n Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014\n Call Trace:\n  dump_stack+0x92/0xc1\n  print_address_description.constprop.7+0x1a/0x150\n  kasan_report.cold.13+0x7f/0x111\n  ip_do_fragment+0x1b03/0x1f60\n  ovs_fragment+0x5bf/0x840 [openvswitch]\n  do_execute_actions+0x1bd5/0x2400 [openvswitch]\n  ovs_execute_actions+0xc8/0x3d0 [openvswitch]\n  ovs_packet_cmd_execute+0xa39/0x1150 [openvswitch]\n  genl_family_rcv_msg_doit.isra.15+0x227/0x2d0\n  genl_rcv_msg+0x287/0x490\n  netlink_rcv_skb+0x120/0x380\n  genl_rcv+0x24/0x40\n  netlink_unicast+0x439/0x630\n  netlink_sendmsg+0x719/0xbf0\n  sock_sendmsg+0xe2/0x110\n  ____sys_sendmsg+0x5ba/0x890\n  ___sys_sendmsg+0xe9/0x160\n  __sys_sendmsg+0xd3/0x170\n  do_syscall_64+0x33/0x40\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\n RIP: 0033:0x7f957079db07\n Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 eb ec ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 24 ed ff ff 48\n RSP: 002b:00007f956ce35a50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e\n RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 00007f957079db07\n RDX: 0000000000000000 RSI: 00007f956ce35ae0 RDI: 0000000000000019\n RBP: 00007f956ce35ae0 R08: 0000000000000000 R09: 00007f9558006730\n R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000\n R13: 00007f956ce37308 R14: 00007f956ce35f80 R15: 00007f956ce35ae0\n\n The buggy address belongs to the page:\n page:00000000af2a1d93 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112fc7\n flags: 0x17ffffc0000000()\n raw: 0017ffffc0000000 0000000000000000 dead000000000122 0000000000000000\n raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n addr ffff888112fc713c is located in stack of task handler2/1367 at offset 180 in frame:\n  ovs_fragment+0x0/0x840 [openvswitch]\n\n this frame has 2 objects:\n  [32, 144) 'ovs_dst'\n  [192, 424) 'ovs_rt'\n\n Memory state around the buggy address:\n  ffff888112fc7000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  ffff888112fc7080: 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00\n >ffff888112fc7100: 00 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00\n                                         ^\n  ffff888112fc7180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  ffff888112fc7200: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00\n\nfor IPv4 packets, ovs_fragment() uses a temporary struct dst_entry. Then,\nin the following call graph:\n\n  ip_do_fragment()\n    ip_skb_dst_mtu()\n      ip_dst_mtu_maybe_forward()\n        ip_mtu_locked()\n\nthe pointer to struct dst_entry is used as pointer to struct rtable: this\nturns the access to struct members like rt_mtu_locked into an OOB read in\nthe stack. Fix this changing the temporary variable used for IPv4 packets\nin ovs_fragment(), similarly to what is done for IPv6 few lines below.","state":"PUBLISHED","assigner":"Linux","published_at":"2024-02-27 19:04:06","updated_at":"2026-08-04 10:16:37"},"problem_types":["CWE-125"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"8.2","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.2","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","data":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/23e17ec1a5eb53fe39cc34fa5592686d5acd0dac","name":"https://git.kernel.org/stable/c/23e17ec1a5eb53fe39cc34fa5592686d5acd0dac","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a1478374b0bda89b4277a8afd39208271faad4be","name":"https://git.kernel.org/stable/c/a1478374b0bda89b4277a8afd39208271faad4be","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d841d3cf5297fde4ce6a41ff35451d0e82917f3e","name":"https://git.kernel.org/stable/c/d841d3cf5297fde4ce6a41ff35451d0e82917f3e","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7c0ea5930c1c211931819d83cfb157bff1539a4c","name":"https://git.kernel.org/stable/c/7c0ea5930c1c211931819d83cfb157bff1539a4c","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b3502b04e84ac5349be95fc033c17bd701d2787a","name":"https://git.kernel.org/stable/c/b3502b04e84ac5349be95fc033c17bd701d2787a","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/df9e900de24637be41879e2c50afb713ec4e8b2e","name":"https://git.kernel.org/stable/c/df9e900de24637be41879e2c50afb713ec4e8b2e","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b1d7280f9ba1bfdbc3af5bdb82e51f014854f26f","name":"https://git.kernel.org/stable/c/b1d7280f9ba1bfdbc3af5bdb82e51f014854f26f","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5a52fa8ad45b5a593ed416adf326538638454ff1","name":"https://git.kernel.org/stable/c/5a52fa8ad45b5a593ed416adf326538638454ff1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/490ad0a2390442d0a7b8c00972a83dbb09cab142","name":"https://git.kernel.org/stable/c/490ad0a2390442d0a7b8c00972a83dbb09cab142","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-46955","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46955","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 119bbaa6795a4f4aed46994cc7d9ab01989c87e3 b1d7280f9ba1bfdbc3af5bdb82e51f014854f26f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d543907a4730400f5c5b684c57cb5bbbfd6136ab 23e17ec1a5eb53fe39cc34fa5592686d5acd0dac git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 8387fbac8e18e26a60559adc63e0b7067303b0a4 5a52fa8ad45b5a593ed416adf326538638454ff1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221 df9e900de24637be41879e2c50afb713ec4e8b2e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221 490ad0a2390442d0a7b8c00972a83dbb09cab142 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221 a1478374b0bda89b4277a8afd39208271faad4be git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221 d841d3cf5297fde4ce6a41ff35451d0e82917f3e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221 b3502b04e84ac5349be95fc033c17bd701d2787a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221 7c0ea5930c1c211931819d83cfb157bff1539a4c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected df9ece1148e2ec242871623dedb004f7a1387125 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.4.134 4.4.269 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.9.104 4.9.269 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.14.45 4.14.233 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.16.57 3.17 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.16","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.16 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.4.269 4.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.9.269 4.9.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.14.233 4.14.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.19.191 4.19.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.4.118 5.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.36 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.11.20 5.11.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.12.3 5.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.13 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"46955","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2021-46955","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-06-28T17:01:12.713223Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2024-06-28T17:01:24.427Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2024-08-04T05:17:42.889Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/b1d7280f9ba1bfdbc3af5bdb82e51f014854f26f"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/23e17ec1a5eb53fe39cc34fa5592686d5acd0dac"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/5a52fa8ad45b5a593ed416adf326538638454ff1"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/df9e900de24637be41879e2c50afb713ec4e8b2e"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/490ad0a2390442d0a7b8c00972a83dbb09cab142"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/a1478374b0bda89b4277a8afd39208271faad4be"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/d841d3cf5297fde4ce6a41ff35451d0e82917f3e"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/b3502b04e84ac5349be95fc033c17bd701d2787a"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/7c0ea5930c1c211931819d83cfb157bff1539a4c"}],"title":"CVE Program Container"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/openvswitch/actions.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b1d7280f9ba1bfdbc3af5bdb82e51f014854f26f","status":"affected","version":"119bbaa6795a4f4aed46994cc7d9ab01989c87e3","versionType":"git"},{"lessThan":"23e17ec1a5eb53fe39cc34fa5592686d5acd0dac","status":"affected","version":"d543907a4730400f5c5b684c57cb5bbbfd6136ab","versionType":"git"},{"lessThan":"5a52fa8ad45b5a593ed416adf326538638454ff1","status":"affected","version":"8387fbac8e18e26a60559adc63e0b7067303b0a4","versionType":"git"},{"lessThan":"df9e900de24637be41879e2c50afb713ec4e8b2e","status":"affected","version":"d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221","versionType":"git"},{"lessThan":"490ad0a2390442d0a7b8c00972a83dbb09cab142","status":"affected","version":"d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221","versionType":"git"},{"lessThan":"a1478374b0bda89b4277a8afd39208271faad4be","status":"affected","version":"d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221","versionType":"git"},{"lessThan":"d841d3cf5297fde4ce6a41ff35451d0e82917f3e","status":"affected","version":"d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221","versionType":"git"},{"lessThan":"b3502b04e84ac5349be95fc033c17bd701d2787a","status":"affected","version":"d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221","versionType":"git"},{"lessThan":"7c0ea5930c1c211931819d83cfb157bff1539a4c","status":"affected","version":"d52e5a7e7ca49457dd31fc8b42fb7c0d58a31221","versionType":"git"},{"status":"affected","version":"df9ece1148e2ec242871623dedb004f7a1387125","versionType":"git"},{"lessThan":"4.4.269","status":"affected","version":"4.4.134","versionType":"semver"},{"lessThan":"4.9.269","status":"affected","version":"4.9.104","versionType":"semver"},{"lessThan":"4.14.233","status":"affected","version":"4.14.45","versionType":"semver"},{"lessThan":"3.17","status":"affected","version":"3.16.57","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/openvswitch/actions.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.16"},{"lessThan":"4.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"4.4.*","status":"unaffected","version":"4.4.269","versionType":"semver"},{"lessThanOrEqual":"4.9.*","status":"unaffected","version":"4.9.269","versionType":"semver"},{"lessThanOrEqual":"4.14.*","status":"unaffected","version":"4.14.233","versionType":"semver"},{"lessThanOrEqual":"4.19.*","status":"unaffected","version":"4.19.191","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.118","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.36","versionType":"semver"},{"lessThanOrEqual":"5.11.*","status":"unaffected","version":"5.11.20","versionType":"semver"},{"lessThanOrEqual":"5.12.*","status":"unaffected","version":"5.12.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"5.13","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.4.269","versionStartIncluding":"4.4.134","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.9.269","versionStartIncluding":"4.9.104","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.14.233","versionStartIncluding":"4.14.45","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.19.191","versionStartIncluding":"4.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.4.118","versionStartIncluding":"4.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.36","versionStartIncluding":"4.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.11.20","versionStartIncluding":"4.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.12.3","versionStartIncluding":"4.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.13","versionStartIncluding":"4.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16.57","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: fix stack OOB read while fragmenting IPv4 packets\n\nrunning openvswitch on kernels built with KASAN, it's possible to see the\nfollowing splat while testing fragmentation of IPv4 packets:\n\n BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60\n Read of size 1 at addr ffff888112fc713c by task handler2/1367\n\n CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+ #418\n Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014\n Call Trace:\n  dump_stack+0x92/0xc1\n  print_address_description.constprop.7+0x1a/0x150\n  kasan_report.cold.13+0x7f/0x111\n  ip_do_fragment+0x1b03/0x1f60\n  ovs_fragment+0x5bf/0x840 [openvswitch]\n  do_execute_actions+0x1bd5/0x2400 [openvswitch]\n  ovs_execute_actions+0xc8/0x3d0 [openvswitch]\n  ovs_packet_cmd_execute+0xa39/0x1150 [openvswitch]\n  genl_family_rcv_msg_doit.isra.15+0x227/0x2d0\n  genl_rcv_msg+0x287/0x490\n  netlink_rcv_skb+0x120/0x380\n  genl_rcv+0x24/0x40\n  netlink_unicast+0x439/0x630\n  netlink_sendmsg+0x719/0xbf0\n  sock_sendmsg+0xe2/0x110\n  ____sys_sendmsg+0x5ba/0x890\n  ___sys_sendmsg+0xe9/0x160\n  __sys_sendmsg+0xd3/0x170\n  do_syscall_64+0x33/0x40\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\n RIP: 0033:0x7f957079db07\n Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 eb ec ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 24 ed ff ff 48\n RSP: 002b:00007f956ce35a50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e\n RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 00007f957079db07\n RDX: 0000000000000000 RSI: 00007f956ce35ae0 RDI: 0000000000000019\n RBP: 00007f956ce35ae0 R08: 0000000000000000 R09: 00007f9558006730\n R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000\n R13: 00007f956ce37308 R14: 00007f956ce35f80 R15: 00007f956ce35ae0\n\n The buggy address belongs to the page:\n page:00000000af2a1d93 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112fc7\n flags: 0x17ffffc0000000()\n raw: 0017ffffc0000000 0000000000000000 dead000000000122 0000000000000000\n raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n addr ffff888112fc713c is located in stack of task handler2/1367 at offset 180 in frame:\n  ovs_fragment+0x0/0x840 [openvswitch]\n\n this frame has 2 objects:\n  [32, 144) 'ovs_dst'\n  [192, 424) 'ovs_rt'\n\n Memory state around the buggy address:\n  ffff888112fc7000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  ffff888112fc7080: 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00\n >ffff888112fc7100: 00 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00\n                                         ^\n  ffff888112fc7180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  ffff888112fc7200: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00\n\nfor IPv4 packets, ovs_fragment() uses a temporary struct dst_entry. Then,\nin the following call graph:\n\n  ip_do_fragment()\n    ip_skb_dst_mtu()\n      ip_dst_mtu_maybe_forward()\n        ip_mtu_locked()\n\nthe pointer to struct dst_entry is used as pointer to struct rtable: this\nturns the access to struct members like rt_mtu_locked into an OOB read in\nthe stack. Fix this changing the temporary variable used for IPv4 packets\nin ovs_fragment(), similarly to what is done for IPv6 few lines below."}],"metrics":[{"cvssV3_1":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"}}],"providerMetadata":{"dateUpdated":"2026-08-04T08:57:57.207Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/b1d7280f9ba1bfdbc3af5bdb82e51f014854f26f"},{"url":"https://git.kernel.org/stable/c/23e17ec1a5eb53fe39cc34fa5592686d5acd0dac"},{"url":"https://git.kernel.org/stable/c/5a52fa8ad45b5a593ed416adf326538638454ff1"},{"url":"https://git.kernel.org/stable/c/df9e900de24637be41879e2c50afb713ec4e8b2e"},{"url":"https://git.kernel.org/stable/c/490ad0a2390442d0a7b8c00972a83dbb09cab142"},{"url":"https://git.kernel.org/stable/c/a1478374b0bda89b4277a8afd39208271faad4be"},{"url":"https://git.kernel.org/stable/c/d841d3cf5297fde4ce6a41ff35451d0e82917f3e"},{"url":"https://git.kernel.org/stable/c/b3502b04e84ac5349be95fc033c17bd701d2787a"},{"url":"https://git.kernel.org/stable/c/7c0ea5930c1c211931819d83cfb157bff1539a4c"}],"title":"openvswitch: fix stack OOB read while fragmenting IPv4 packets","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2021-46955","datePublished":"2024-02-27T18:46:57.428Z","dateReserved":"2024-02-27T18:42:55.937Z","dateUpdated":"2026-08-04T08:57:57.207Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2024-02-27 19:04:06","lastModifiedDate":"2026-08-04 10:16:37","problem_types":["CWE-125"],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-06-28T17:01:12.713223Z","id":"CVE-2021-46955","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.134","versionEndExcluding":"4.4.269","matchCriteriaId":"65ED7534-D47C-47CE-BF7D-8022A6B38C4B"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.104","versionEndExcluding":"4.9.269","matchCriteriaId":"634D2BFA-73FA-4C9A-B897-11E3DD69E039"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.45","versionEndExcluding":"4.14.233","matchCriteriaId":"4C007C3B-E2A3-42E4-97C1-FDAC6B8515E9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"4.19.191","matchCriteriaId":"F677F1C8-2451-43EC-9555-E283697C189E"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"5.4.118","matchCriteriaId":"C83F5505-AF9D-4F2A-8D37-A8EB73ED772D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.10.36","matchCriteriaId":"003E22D0-CA29-4338-8B35-0754C740074F"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.11.20","matchCriteriaId":"EEC03413-9760-46D4-AC1D-EB084A1D4111"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"5.12.3","matchCriteriaId":"F9D6B2DE-7E4A-4B3B-9AEE-3A2C5F23DA32"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"46955","Ordinal":"1","Title":"openvswitch: fix stack OOB read while fragmenting IPv4 packets","CVE":"CVE-2021-46955","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"46955","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: fix stack OOB read while fragmenting IPv4 packets\n\nrunning openvswitch on kernels built with KASAN, it's possible to see the\nfollowing splat while testing fragmentation of IPv4 packets:\n\n BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60\n Read of size 1 at addr ffff888112fc713c by task handler2/1367\n\n CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+ #418\n Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014\n Call Trace:\n  dump_stack+0x92/0xc1\n  print_address_description.constprop.7+0x1a/0x150\n  kasan_report.cold.13+0x7f/0x111\n  ip_do_fragment+0x1b03/0x1f60\n  ovs_fragment+0x5bf/0x840 [openvswitch]\n  do_execute_actions+0x1bd5/0x2400 [openvswitch]\n  ovs_execute_actions+0xc8/0x3d0 [openvswitch]\n  ovs_packet_cmd_execute+0xa39/0x1150 [openvswitch]\n  genl_family_rcv_msg_doit.isra.15+0x227/0x2d0\n  genl_rcv_msg+0x287/0x490\n  netlink_rcv_skb+0x120/0x380\n  genl_rcv+0x24/0x40\n  netlink_unicast+0x439/0x630\n  netlink_sendmsg+0x719/0xbf0\n  sock_sendmsg+0xe2/0x110\n  ____sys_sendmsg+0x5ba/0x890\n  ___sys_sendmsg+0xe9/0x160\n  __sys_sendmsg+0xd3/0x170\n  do_syscall_64+0x33/0x40\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\n RIP: 0033:0x7f957079db07\n Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 eb ec ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 24 ed ff ff 48\n RSP: 002b:00007f956ce35a50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e\n RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 00007f957079db07\n RDX: 0000000000000000 RSI: 00007f956ce35ae0 RDI: 0000000000000019\n RBP: 00007f956ce35ae0 R08: 0000000000000000 R09: 00007f9558006730\n R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000\n R13: 00007f956ce37308 R14: 00007f956ce35f80 R15: 00007f956ce35ae0\n\n The buggy address belongs to the page:\n page:00000000af2a1d93 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112fc7\n flags: 0x17ffffc0000000()\n raw: 0017ffffc0000000 0000000000000000 dead000000000122 0000000000000000\n raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n addr ffff888112fc713c is located in stack of task handler2/1367 at offset 180 in frame:\n  ovs_fragment+0x0/0x840 [openvswitch]\n\n this frame has 2 objects:\n  [32, 144) 'ovs_dst'\n  [192, 424) 'ovs_rt'\n\n Memory state around the buggy address:\n  ffff888112fc7000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  ffff888112fc7080: 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00\n >ffff888112fc7100: 00 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00\n                                         ^\n  ffff888112fc7180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  ffff888112fc7200: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00\n\nfor IPv4 packets, ovs_fragment() uses a temporary struct dst_entry. Then,\nin the following call graph:\n\n  ip_do_fragment()\n    ip_skb_dst_mtu()\n      ip_dst_mtu_maybe_forward()\n        ip_mtu_locked()\n\nthe pointer to struct dst_entry is used as pointer to struct rtable: this\nturns the access to struct members like rt_mtu_locked into an OOB read in\nthe stack. Fix this changing the temporary variable used for IPv4 packets\nin ovs_fragment(), similarly to what is done for IPv6 few lines below.","Type":"Description","Title":"openvswitch: fix stack OOB read while fragmenting IPv4 packets"}]}}}