CVE-2021-47619

What it actually does

NULL pointer dereference in i40e_xdp due to PF queue pile fragmentation when flow director VSI placement prevents main VSI from allocating queues for XDP on high-CPU systems with X722 NICs.

Why it matters to the business

Kernel panic and system reboot when XDP is enabled on affected Intel Ethernet adapters, causing loss of network connectivity and service disruption on servers using these NICs.

How an attack unfolds

An attacker with sufficient privileges to attach an XDP program to a network interface triggers the bug by calling dev_change_xdp_fd, which leads to failed queue reservation and subsequent NULL dereference in the i40e driver during VSI reconfiguration.

How to fix it

Update to a Linux kernel containing the fix that reserves the last queue in the PF queue pile exclusively for the flow director VSI before enabling XDP on i40e devices.

How to confirm the fix worked

Confirm kernel version includes the i40e queue reservation change; attempt to attach XDP on an X722 interface with many CPUs and verify no NULL dereference occurs in i40e_xdp.

Typical attack path

1. Obtain local privileges sufficient to modify network interface settings
2. Issue netlink request to attach XDP program via dev_change_xdp_fd
3. Driver attempts to resize main VSI queues but fails due to prior flow director VSI placement
4. i40e_xdp encounters NULL pointer and triggers kernel oops

How to detect it

Search kernel logs for i40e messages about failed queue tracking for VSI, NULL pointer dereference in i40e_xdp, or setup failures of MAIN VSI during XDP configuration attempts.

What your security team should do

• Prioritize kernel updates on systems with X722 or similar i40e NICs that may use XDP
• Restrict unprivileged users from attaching XDP programs until patched
• Monitor for kernel oops involving i40e_xdp in system logs