https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 13:45:50 +0000 https://cve.radiocsirt.org/vuln/cve-2021-47013 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send</p> <p>In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..). If some error happens in emac_tx_fill_tpd(), the skb will be freed via dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd(). But the freed skb is still used via skb-&gt;len by netdev_sent_queue(,skb-&gt;len).</p> <p>As i observed that emac_tx_fill_tpd() haven&#39;t modified the value of skb-&gt;len, thus my patch assigns skb-&gt;len to &#39;len&#39; before the possible free and use &#39;len&#39; instead of skb-&gt;len later.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send</p> <p>In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..). If some error happens in emac_tx_fill_tpd(), the skb will be freed via dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd(). But the freed skb is still used via skb-&gt;len by netdev_sent_queue(,skb-&gt;len).</p> <p>As i observed that emac_tx_fill_tpd() haven&#39;t modified the value of skb-&gt;len, thus my patch assigns skb-&gt;len to &#39;len&#39; before the possible free and use &#39;len&#39; instead of skb-&gt;len later.</p> https://cve.radiocsirt.org/vuln/cve-2021-47013