CVE-2021-47515

Q: What is the severity of CVE-2021-47515?

CVE-2021-47515 has a CVSS score of 5.5 (MEDIUM). This Linux kernel vulnerability occurs when IPv4 packets are encapsulated in IPv6+SRH headers, causing the receiving interface index to be cleared from the socket control block. This can lead to a NULL pointer dereference when forwarding packets, potentially causing kernel panics or denial of service. Systems running affected Linux kernel versions with IPv6 Segment Routing (SRv6) enabled are vulnerable.

5.5 MEDIUM

Denial of Service

📋 TL;DR

This Linux kernel vulnerability occurs when IPv4 packets are encapsulated in IPv6+SRH headers, causing the receiving interface index to be cleared from the socket control block. This can lead to a NULL pointer dereference when forwarding packets, potentially causing kernel panics or denial of service. Systems running affected Linux kernel versions with IPv6 Segment Routing (SRv6) enabled are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions from commit ef489749aae5 (2019-01-29) through fixes in stable branches (5.10.84, 5.15.8, 5.16-rc4+)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when IPv6 Segment Routing (SRv6) is enabled and systems process IPv4-in-IPv6 encapsulation with SRH headers.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, requiring physical or remote console access to reboot.

🟠

Likely Case

System instability or crashes when processing specific IPv4-in-IPv6 encapsulated traffic with SRH headers.

🟢

If Mitigated

No impact if IPv6 Segment Routing is disabled or systems are not processing the specific encapsulation traffic.

🌐 Internet-Facing: MEDIUM - Requires specific network traffic patterns but could be triggered by malicious packets from external sources.

🏢 Internal Only: LOW - Requires internal systems to send specially crafted encapsulated packets to vulnerable systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires sending specially crafted network packets to trigger the NULL pointer dereference. No public exploit code has been identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel versions: 5.10.84, 5.15.8, 5.16-rc4+ and later stable branches

Vendor Advisory: https://git.kernel.org/stable/c/6431e71093f3da586a00c6d931481ffb0dc2db0e

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version with 'uname -r'.

🔧 Temporary Workarounds

Disable IPv6 Segment Routing

linux

Disable SRv6 functionality to prevent the vulnerable code path from being triggered

sysctl -w net.ipv6.conf.all.seg6_enabled=0
sysctl -w net.ipv6.conf.default.seg6_enabled=0

Block SRH encapsulation traffic

linux

Use firewall rules to block IPv6 packets with Segment Routing Headers

iptables -A INPUT -p ipv6 --ipv6-extension seg6 -j DROP
ip6tables -A INPUT -m rt --rt-type 4 -j DROP

🧯 If You Can't Patch

Implement network filtering to block SRH-encapsulated traffic at perimeter
Disable IPv6 Segment Routing on all affected systems using sysctl commands

🔍 How to Verify

Check if Vulnerable:

Check kernel version with 'uname -r' and compare against affected versions. Check if SRv6 is enabled with 'sysctl net.ipv6.conf.all.seg6_enabled'.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched (5.10.84+, 5.15.8+, or 5.16-rc4+). Test SRv6 functionality if required for operations.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/messages or dmesg
NULL pointer dereference errors in kernel logs
System crash/reboot events

Network Indicators:

Unusual IPv6 traffic with SRH headers
Spike in malformed packet drops

SIEM Query:

source="kernel" AND ("NULL pointer dereference" OR "kernel panic" OR "seg6")

📊 Metadata

CVE ID: CVE-2021-47515

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: May 24, 2024

Last Updated: September 24, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable IPv6 Segment Routing

Block SRH encapsulation traffic

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities