CVE-2021-47501

What it actually does

NULL pointer dereference crash in i40e_dbg_dump_desc when debugfs is used to dump RX/TX descriptors for a VF VSI whose type does not support the operation.

Why it matters to the business

A local privileged user can trigger a kernel panic on systems using Intel i40e NICs, causing immediate denial of service and potential loss of network connectivity until reboot.

How an attack unfolds

An attacker with sufficient privileges to access the i40e debugfs interface invokes the descriptor dump function on an unsupported VSI type, bypassing the missing type check and dereferencing a NULL pointer inside the kernel module.

How to fix it

Apply the upstream fix that adds the VSI type validation check in i40e_dbg_dump_desc; update to a kernel release containing the resolution for CVE-2021-47501. Disable or restrict access to i40e debugfs entries if the driver is not required for diagnostics.

How to confirm the fix worked

Confirm the running kernel contains the added VSI type check in i40e_dbg_dump_desc; attempt the previously crashing debugfs dump operation on a non-supported VSI and verify it returns an error instead of crashing.

Typical attack path

1. Obtain local root or CAP_SYS_ADMIN access on a system with the i40e driver loaded
2. Navigate to the i40e debugfs directory for the target device
3. Execute the VF descriptor dump command against a VSI that is not of a supported type
4. Trigger the NULL dereference and resulting kernel oops/panic

How to detect it

Review kernel logs for oops/panic traces containing i40e_dbg_dump_desc and NULL pointer dereference; inspect audit logs for access to i40e debugfs entries immediately preceding crashes.

What your security team should do

• Prioritize patching systems that expose i40e debugfs to untrusted local users
• Audit kernel configurations to ensure debugfs is mounted with restricted permissions
• Monitor EPSS and exploit maturity; current low stable score indicates limited in-the-wild risk