CVE-2021-46991

i40e: Fix use-after-free in i40e_client_subtask()

HIGH

7.8

CVSS Score

Published: February 28, 2024 at 08:13 AM UTC

Updated: June 17, 2026 at 04:16 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix use-after-free in i40e_client_subtask() Currently the call to i40e_client_del_instance frees the object pf->cinst, however pf->cinst->lan_info is being accessed after the free. Fix this by adding the missing return. Addresses-Coverity: ("Read from pointer after free")

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

4.16 ≤ v < 4.19.1914.16 ≤ v < 5.10.384.16 ≤ v < 5.11.224.16 ≤ v < 5.12.54.16 ≤ v < 5.134.16 ≤ v < 5.4.1204.20 ≤ v < 5.4.1205.11 ≤ v < 5.11.225.12 ≤ v < 5.12.55.5 ≤ v < 5.10.384.167b0b1a6d0ac983ce1928432285d0222d4fb7c38b

Vendor states this is fixed in 1fd5d262e7442192ac7611ff1597a36c5b044323 (fixed)

Vendor states this is fixed in 38318f23a7ef86a8b1862e5e8078c4de121960c3 (fixed)

Vendor states this is fixed in 4ebc10aa7cd17fd9857dedac69600465c9dd16d1 (fixed)

Vendor states this is fixed in 829a713450b8fb127cbabfc1244c1d8179ec5107 (fixed)

Vendor states this is fixed in c1322eaeb8af0d8985b5cc5fa759140fa0e57b84 (fixed)

Vendor states this is fixed in d718c15a2bf9ae082d5ae4d177fb19ef23cb4132 (fixed)

Vendor states this is fixed in 4.16 (unaffected)

Vendor states this is fixed in 4.19.191 (unaffected)

Vendor states this is fixed in 5.10.38 (unaffected)

Vendor states this is fixed in 5.11.22 (unaffected)

Vendor states this is fixed in 5.12.5 (unaffected)

Vendor states this is fixed in 5.13 (unaffected)