CVE-2021-46908: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-46908 is a vulnerability in the Linux kernel that affects versions from 5.8.0 up to (excluding) 5.10.32 and from 5.11.0 up to (excluding) 5.11.16. The vulnerability relates to the handling of mixed signed bounds arithmetic in the BPF subsystem, specifically in relation to Spectre v1 masking mitigation (NVD, RedHat).

The vulnerability stems from using an incorrect permission flag for mixed signed bounds arithmetic in the BPF subsystem. The issue occurs because adding unknown scalars with mixed signed bounds is forbidden due to the Spectre v1 masking mitigation, requiring the bypass_spec_v1 flag instead of the previously used allow_ptr_leaks flag. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability primarily affects system availability, with a High impact rating for availability but no direct impact on confidentiality or integrity. The issue requires local access and low privileges to exploit (NVD).

The vulnerability has been fixed through a patch that corrects the permission flag usage, changing from allow_ptr_leaks to bypass_spec_v1 flag. The fix was implemented in the Linux kernel source code through commit 9601148392520e2e134936e76788fc2a6371e7be (Kernel Patch).