CVE-2021-47495

What it actually does

Missing input validation in the Linux kernel usbnet driver permits a maxpacket value of zero, resulting in division by zero and an immediate kernel oops.

Why it matters to the business

Linux systems using USB network devices face risk of sudden kernel crashes that interrupt network connectivity and require reboots, though exploitation remains unlikely given low EPSS and absence from known campaigns.

How an attack unfolds

An attacker with physical or local access attaches a USB device that reports a maxpacket size of zero; the usbnet driver performs no sanity check and crashes the kernel during initialization when attempting to divide by the invalid value.

How to fix it

Apply the upstream patch that adds the maxpacket sanity check to usbnet; rebuild and deploy updated Linux kernels across affected distributions.

How to confirm the fix worked

Confirm the sanity check exists in the usbnet source (search for maxpacket == 0 guard) or test initialization with a device that reports zero maxpacket without triggering an oops.

Typical attack path

1. Attacker connects USB device advertising maxpacket=0
2. usbnet driver binds and reads device parameters
3. Division by zero occurs during packet-size calculations
4. Kernel oops or panic halts the system

How to detect it

Scan kernel logs and dmesg output for usbnet division-by-zero faults or panic messages referencing maxpacket; correlate with USB device attachment events.

• usbnet: maxpacket of 0
• divide error in usbnet
• kernel BUG at drivers/net/usb/usbnet.c

What your security team should do

• Prioritize kernel updates on systems exposing USB network interfaces
• Review kernel logs for usbnet-related oops entries
• Limit untrusted USB device attachment via policy where feasible