CVE-2021-47223

What it actually does

Null pointer dereference in the bridge VLAN tunnel egress path caused by setting tunnel_dst to NULL without an RCU grace period while concurrent lockless readers still dereference it.

Why it matters to the business

Kernel crash or denial of service on systems using Linux bridging with VLAN tunnels, potentially disrupting network connectivity and requiring reboots.

How an attack unfolds

An attacker with local access configures a bridge VLAN tunnel then concurrently deletes the tunnel while triggering packet egress; the race allows a NULL dereference before RCU-protected reads can be enforced.

How to fix it

Apply the upstream kernel patch that introduces READ/WRITE_ONCE annotations and proper RCU-protected single-read checks for tunnel_dst and tunnel_id; upgrade to a kernel containing the fix referenced for the affected package versions.

How to confirm the fix worked

Confirm the presence of RCU read-side critical sections around tunnel_dst access and absence of direct NULL dereferences in the bridge egress code path after patching.

Typical attack path

1. Create a Linux bridge with a VLAN tunnel configuration
2. Trigger deletion of the VLAN tunnel entry
3. Simultaneously send or forward packets through the egress path
4. Trigger the unprotected NULL read of tunnel_dst leading to crash

How to detect it

Inspect kernel logs for oops or panic messages referencing bridge tunnel_dst or vlan tunnel egress; look for concurrent bridge configuration changes in system audit logs around the time of any crashes.

What your security team should do

• Prioritize patching systems that use bridge VLAN tunnels
• Monitor for bridge-related kernel oops or panic logs
• Restrict unprivileged local access until patches are deployed