CVE-2021-47301

What it actually does

Use-after-free in the igb network driver occurs when next_to_watch is not cleared during TX ring cleanup; igb_poll() running concurrently with a controller reset can attempt to free an skb that has already been freed, resulting in invalid memory access.

Why it matters to the business

Systems using affected Intel igb network hardware may experience unexpected crashes or instability during network resets, leading to service interruptions and potential loss of network connectivity until the system is restarted.

How an attack unfolds

An attacker with local access or the ability to trigger network resets manipulates TX ring state so that igb_poll() executes while the controller is resetting; this causes the driver to dereference and free an already-freed socket buffer, resulting in a kernel crash or memory corruption.

How to fix it

Apply the upstream kernel fix that clears next_to_watch during TX ring cleanup; rebuild and deploy the patched kernel on all affected systems; reboot after installation.

How to confirm the fix worked

Confirm the patched kernel is running, then exercise network reset and poll paths under load while monitoring for use-after-free warnings or crashes in dmesg; verify the next_to_watch clearing logic is present in the igb driver source.

Typical attack path

1. Gain local execution or network control sufficient to trigger device reset conditions
2. Force or wait for igb_poll() to run concurrently with controller reset
3. Trigger the race that leaves next_to_watch pointing to a freed descriptor
4. Cause the driver to attempt double-free of the skb

How to detect it

Search kernel logs (dmesg, syslog) for igb driver oops, skb double-free warnings, or invalid memory access traces occurring around device reset events; correlate with network interface reset timestamps.

What your security team should do

• Prioritize patching systems that use igb-based network adapters and expose network services
• Monitor vendor and distribution kernel updates for the igb use-after-free fix
• Test the updated kernel in a staging environment with network reset workloads before broad deployment
• Review logs for any prior oops or skb double-free messages on production systems