CVE-2021-47036

What it actually does

The kernel's udp_gro_receive path performed L4 aggregation (SKB_GSO_UDP_L4 or SKB_GSO_FRAGLIST) on outer UDP packets that carried tunnel headers such as VXLAN, causing packets with differing inner headers or VXLAN IDs to be merged and inner protocol state to be ignored or corrupted.

Why it matters to the business

Network traffic traversing UDP tunnels can experience silent data corruption or unexpected packet drops, degrading connectivity for overlay networks, containers, and virtual machines until the system is updated.

How an attack unfolds

An attacker sends a stream of UDP packets that appear to belong to the same flow at the outer layer but carry distinct inner tunnel headers; when GRO is enabled the receiver aggregates them incorrectly, resulting in corrupted inner packets delivered to the tunnel endpoint.

How to fix it

Apply the upstream fix that adds the tunnel check in udp_gro_receive; rebuild and deploy a kernel containing commit that skips SKB_GSO_UDP_L4 and SKB_GSO_FRAGLIST for potential tunnel packets.

How to confirm the fix worked

Confirm the patched udp_gro_receive function contains the early return when udp_sk(sk)->gro_receive is present; run network stress tests with VXLAN or Geneve traffic while monitoring for inner-header corruption.

Typical attack path

1. Attacker transmits UDP packets with varying inner tunnel identifiers toward a GRO-enabled receiver
2. udp_gro_receive aggregates the packets at the outer UDP layer instead of deferring to per-tunnel GRO logic
3. Inner headers are discarded or merged, producing a single GSO packet with mixed tunnel state
4. The corrupted GSO packet is eventually flushed to the tunnel stack, causing protocol errors or data loss

How to detect it

Inspect kernel ring buffer and network driver logs for repeated GRO-related warnings or malformed tunnel packets; correlate with tcpdump or pktgen captures showing aggregated VXLAN frames that contain mismatched VNI values.

What your security team should do

• Prioritize kernel updates on hosts that terminate UDP tunnels or run container/VM overlay networks
• Temporarily disable GRO_FRAGLIST and GRO_UDP_FWD on affected interfaces if immediate patching is not possible
• Monitor EPSS trend and kernel mailing-list activity for any newly published exploits