CVE-2021-46998

What it actually does

Use-after-free in the ENIC Ethernet driver transmit path: enic_hard_start_xmit calls enic_queue_wq_skb which may call dev_kfree_skb on error, after which skb_tx_timestamp still dereferences the freed skb.

Why it matters to the business

Kernel instability, crashes, or potential code execution on systems using the ENIC driver, resulting in denial of service or full system compromise; urgency is low given low EPSS and no known exploitation.

How an attack unfolds

An attacker sends network traffic that triggers an error path inside enic_queue_wq_skb, causing premature skb free followed by a subsequent use in skb_tx_timestamp.

How to fix it

Apply the upstream fix that makes enic_queue_wq_skb return an error and jump to spin_unlock on failure; update to a Linux kernel containing commit resolving CVE-2021-46998.

How to confirm the fix worked

Confirm the corrected control flow in enic_hard_start_xmit and enic_queue_wq_skb in kernel source; test transmit error paths with the ENIC driver loaded.

Typical attack path

1. Send specially crafted packets to an interface using the ENIC driver
2. Force enic_queue_wq_skb error condition that frees the skb
3. Trigger skb_tx_timestamp access on the now-freed buffer

How to detect it

Inspect kernel logs for oops/panic messages referencing enic_hard_start_xmit or skb_tx_timestamp; review audit logs for unexpected ENIC transmit failures around the time of any crash.

What your security team should do

• Apply kernel updates containing the ENIC driver fix as soon as available from the distribution
• Monitor EPSS and KEV status for any change indicating increased risk
• Restrict use of ENIC hardware to trusted networks until patched