https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 17:04:20 +0000 https://cve.radiocsirt.org/vuln/cve-2021-47388 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mac80211: fix use-after-free in CCMP/GCMP RX</p> <p>When PN checking is done in mac80211, for fragmentation we need to copy the PN to the RX struct so we can later use it to do a comparison, since commit bf30ca922a0c (&#34;mac80211: check defrag PN against current frame&#34;).</p> <p>Unfortunately, in that commit I used the &#39;hdr&#39; variable without it being necessarily valid, so use-after-free could occur if it was necessary to reallocate (parts of) the frame.</p> <p>Fix this by reloading the variable after the code that results in the reallocations, if any.</p> <p>This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mac80211: fix use-after-free in CCMP/GCMP RX</p> <p>When PN checking is done in mac80211, for fragmentation we need to copy the PN to the RX struct so we can later use it to do a comparison, since commit bf30ca922a0c (&#34;mac80211: check defrag PN against current frame&#34;).</p> <p>Unfortunately, in that commit I used the &#39;hdr&#39; variable without it being necessarily valid, so use-after-free could occur if it was necessary to reallocate (parts of) the frame.</p> <p>Fix this by reloading the variable after the code that results in the reallocations, if any.</p> <p>This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.</p> https://cve.radiocsirt.org/vuln/cve-2021-47388