CVE-2021-47077: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47077 is a vulnerability in the Linux kernel's SCSI QLogic FastLinQ offload FCoE driver (qedf). The issue was discovered when the qedf_link_update() API is called from QED before shost_data initialization, resulting in a NULL pointer dereference when attempting to update supported_speeds (NVD).

The vulnerability is a NULL pointer dereference issue (CWE-476) in the qedf_update_link_speed() function. The bug occurs in the Linux kernel versions from 4.11 through 5.10.40, 5.11 through 5.12.7, and 5.13-rc1/rc2. The CVSS v3.1 base score is 5.5 (Medium) with vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a system crash due to NULL pointer dereference when the qedf_link_update() function attempts to access uninitialized shost_data while updating supported speeds. This primarily affects system availability through a potential denial of service condition (Kernel Patch).

The vulnerability requires local access and low privileges to exploit. The attack complexity is low, but user interaction is not required. The scope is unchanged, meaning the impact is limited to the vulnerable component (NVD).

The issue has been fixed by adding NULL pointer checks in the qedf_update_link_speed() function before dereferencing shost_data. The fix was implemented through patches in the Linux kernel. Users should update to kernel versions that include the security fix (Kernel Patch).