CVE-2021-47126: 
Linux Kernel vulnerability analysis and mitigation

A slab-out-of-bounds read vulnerability was discovered in the Linux kernel's IPv6 routing implementation, specifically in the fib6_nh_flush_exceptions function (CVE-2021-47126). The issue was discovered by syzbot in the Linux kernel using Debian clang version 11.0.1-2. The vulnerability was reported and fixed in 2021 (NVD).

The vulnerability occurs in the ip6_route_info_create function when a nexthop pointer (nh) is not NULL, but the fib6_nh in fib6_info has not been allocated. When attempting to free fib6_info using fib6_info_release, the function calls fib6_info_destroy_rcu, which tries to access fib6_nh_release(f6i->fib6_nh). However, since f6i->fib6_nh doesn't have any refcount due to lack of allocation, this results in a slab-out-of-bounds read (Kernel Commit).

The vulnerability could lead to memory corruption and potential system instability. The CVSS v3.1 base score is 5.5 (Medium), indicating moderate severity with local access required (NVD).

The vulnerability requires local access and can be triggered through specific IPv6 routing operations. It was discovered through automated testing using the syzkaller kernel fuzzer, suggesting it could be reliably reproduced under controlled conditions (Kernel Commit).

The issue has been fixed by modifying the error handling path in the ip6_route_info_create function to properly free resources and prevent the invalid memory access. The fix involves releasing the empty pointer directly instead of attempting to access unallocated memory (Kernel Commit).