CVE-2021-47559

What it actually does

NULL pointer dereference in net/smc smc_vlan_by_tcpsk() when netdev_lower_get_next returns NULL and the result is passed to is_vlan_dev without a check.

Why it matters to the business

Local users can trigger a kernel crash or denial of service on affected Linux systems, interrupting services and requiring reboot.

How an attack unfolds

An attacker with local access crafts network configuration or traffic that causes the SMC VLAN lookup to walk lower devices, hitting the unchecked NULL return from netdev_lower_get_next and dereferencing it.

How to fix it

Apply the upstream fix that replaces the manual lower-device walk with netdev_walk_all_lower_dev; update to a kernel containing the resolution for CVE-2021-47559. For the listed chromium packages on Debian 11, upgrade to 119.0.6045.105-1~deb11u1 or newer.

How to confirm the fix worked

Confirm the patched kernel or chromium package is installed, then exercise SMC/VLAN code paths while monitoring for NULL dereference panics; review source for absence of the manual netdev_lower_get_next loop.

Typical attack path

1. Obtain local user or process execution on the target host
2. Trigger SMC socket or VLAN-related network operations that invoke smc_vlan_by_tcpsk
3. Force netdev_lower_get_next to return NULL during lower-device iteration
4. Cause is_vlan_dev call on the NULL pointer, resulting in kernel panic

How to detect it

Search kernel logs and dmesg for NULL dereference oops involving smc_vlan_by_tcpsk or is_vlan_dev; look for SMC socket activity preceding crashes.

What your security team should do

• Prioritize patching systems that use SMC or VLAN networking
• Restrict local user access until fixed
• Monitor kernel logs for related oops or NULL dereference events
• Apply the exact fixed chromium versions on Debian 11 where applicable