# ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()

CVE record · `CVE-2021-47548`

- **Identifiers:** `CVE-2021-47548`
- **State:** Confirmed
- **Severity:** CVSS 9.8 Critical
- **Critical:** Yes: CVSS 9+
- **CNA:** Linux
- **Weakness (CWE):** [CWE-129](https://cwe.mitre.org/data/definitions/129.html)
- **Tags:** [CWE-129](https://agentprime.io/advisories/tag/cwe-129.md)
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 24 May 2024
- **Updated:** 11 May 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 24 May 2024, 15:09 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Critical

Critical, because:

- CVSS score 9.8: 9.0 or more.

How we decide what’s critical: <https://agentprime.io/advisories/critical.md>

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `850bfa3b78ea8849fef78ed74f5f2ccf947db0ca to before 948968f8747650447c8f21c9fdba0e1973be040b` (git)
  - affected: `850bfa3b78ea8849fef78ed74f5f2ccf947db0ca to before abbd5faa0748d0aa95d5191d56ff7a17a6275bd1` (git)
  - affected: `850bfa3b78ea8849fef78ed74f5f2ccf947db0ca to before dd07f8971b81ad98cc754b179b331b57f35aa1ff` (git)
  - affected: `850bfa3b78ea8849fef78ed74f5f2ccf947db0ca to before 99bb25cb6753beaf2c2bc37927c2ecc0ceff3f6d` (git)
  - affected: `850bfa3b78ea8849fef78ed74f5f2ccf947db0ca to before 22519eff7df2d88adcc2568d86046ce1e2b52803` (git)
  - affected: `850bfa3b78ea8849fef78ed74f5f2ccf947db0ca to before fc7ffa7f10b9454a86369405d9814bf141b30627` (git)
  - affected: `850bfa3b78ea8849fef78ed74f5f2ccf947db0ca to before a66998e0fbf213d47d02813b9679426129d0d114` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `4.7`
  - unaffected: `before 4.7` (semver)
  - unaffected: `4.9.292 to 4.9.*, inclusive` (semver)
  - unaffected: `4.14.257 to 4.14.*, inclusive` (semver)
  - unaffected: `4.19.220 to 4.19.*, inclusive` (semver)
  - unaffected: `5.4.164 to 5.4.*, inclusive` (semver)
  - unaffected: `5.10.84 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.7 to 5.15.*, inclusive` (semver)
  - unaffected: `5.16 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 9.8 Critical, CVSS 3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, from ADP (CISA-ADP)

- **CISA KEV:** Not listed.
- **EPSS:** 0.014, the 71st percentile, on 8 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 24 May 2024. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2021-47548](https://www.cve.org/CVERecord?id=CVE-2021-47548)
- [NVD: CVE-2021-47548](https://nvd.nist.gov/vuln/detail/CVE-2021-47548)

### References from the CNA

- <https://git.kernel.org/stable/c/948968f8747650447c8f21c9fdba0e1973be040b>
- <https://git.kernel.org/stable/c/abbd5faa0748d0aa95d5191d56ff7a17a6275bd1>
- <https://git.kernel.org/stable/c/dd07f8971b81ad98cc754b179b331b57f35aa1ff>
- <https://git.kernel.org/stable/c/99bb25cb6753beaf2c2bc37927c2ecc0ceff3f6d>
- <https://git.kernel.org/stable/c/22519eff7df2d88adcc2568d86046ce1e2b52803>
- <https://git.kernel.org/stable/c/fc7ffa7f10b9454a86369405d9814bf141b30627>
- <https://git.kernel.org/stable/c/a66998e0fbf213d47d02813b9679426129d0d114>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2021-47548>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2021-47548/>. Everything for agents: <https://agentprime.io/llms.txt>.