CVE-2021-47556

What it actually does

NULL pointer dereference in ethtool_set_coalesce() ioctl handler when a driver supplies only .get_coalesce() (with coalesce_supported) or only .set_coalesce(), because the availability check is inverted; results in kernel crash (A:H) instead of -EOPNOTSUPP.

Why it matters to the business

Local denial-of-service risk on Linux systems; an authenticated user can crash the kernel by attempting to change network coalesce settings on drivers that implement only one of the two callbacks, disrupting availability until reboot.

How an attack unfolds

A local attacker invokes the legacy ethtool ioctl (SIOCETHTOOL) with ETHTOOL_SCOALESCE on an interface whose driver registers only one callback; the flawed check passes, the missing function pointer is dereferenced, and the kernel panics. The flaw does not affect the netlink path or the ethtool(8) utility's normal usage.

How to fix it

Upgrade the Linux kernel to a release containing the corrected availability check that requires both callbacks before calling ethtool_set_coalesce(); rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the source contains the corrected condition that tests for both .get_coalesce() and .set_coalesce() (and matches the netlink implementation); attempt the ioctl on a one-callback driver and verify -EOPNOTSUPP is returned instead of a crash.

Typical attack path

1. Obtain local shell on affected Linux system
2. Identify network interface whose driver supplies only one coalesce callback
3. Issue ETHTOOL_SCOALESCE ioctl directly or via crafted program
4. Kernel executes ethtool_set_coalesce() with NULL pointer
5. System panics and reboots

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for NULL pointer dereference oops with stack trace referencing ethtool_set_coalesce and the ethtool ioctl path; correlate with processes invoking ETHTOOL_SCOALESCE.

• ethtool_set_coalesce
• NULL dereference.*ethtool
• SIOCETHTOOL.*ETHTOOL_SCOALESCE
• kernel: BUG: unable to handle kernel NULL pointer

What your security team should do

• Prioritize kernel updates on systems exposing ethtool ioctl to untrusted local users
• Restrict ethtool usage via SELinux/AppArmor or capabilities where feasible
• Monitor kernel logs for oops/panic strings containing ethtool_set_coalesce