CVE-2021-47184

What it actually does

Null pointer dereference in the i40e network driver when the VSI filter sync subtask runs after VSI resources have already been released during deletion.

Why it matters to the business

Systems using affected Intel Ethernet adapters can experience kernel crashes or unexpected reboots during network interface teardown or reconfiguration, causing service interruption and potential data loss on servers and appliances.

How an attack unfolds

An attacker with local access triggers concurrent VSI removal and filter list updates in the i40e driver; the missing synchronization flag allows the sync subtask to dereference a freed or uninitialized VSI pointer, resulting in a kernel oops.

How to fix it

Apply the upstream kernel patch that introduces the I40E_VSI_RELEASING flag and prevents filter sync after VSI release; update to a fixed kernel version containing commit resolving the race in i40e driver.

How to confirm the fix worked

Confirm the presence of the I40E_VSI_RELEASING flag definition and the associated checks in the VSI filter sync path; test by exercising repeated VSI create/delete operations under load and verify absence of NULL dereference oops.

Typical attack path

1. Obtain local code execution on a system using the i40e driver
2. Trigger network interface or VSI creation followed by rapid deletion or release
3. Force or race the filter sync subtask to operate on the released VSI
4. Cause NULL pointer dereference and kernel panic

How to detect it

Review kernel logs for oops or panic messages referencing i40e and VSI filter sync or null pointer dereference around network interface removal events; correlate with audit logs showing recent VSI or interface deletion activity.

What your security team should do

• Prioritize kernel updates on all systems exposing the i40e driver
• Monitor vendor advisories for backported fixes in distribution kernels
• Restrict unprivileged local access where kernel updates cannot be applied immediately