CVE-2021-47363 is a vulnerability identified in the Linux kernel's networking subsystem, specifically within the nexthop resilient group implementation. The issue arises from a division by zero error that occurs when the kernel attempts to replace a resilient nexthop group with a stub resilient table that has zero buckets. This situation can happen during the execution of the fib_nexthop.sh torture tests, which repeatedly replace a resilient nexthop group while forwarding traffic. The tests do not specify the number of buckets during replacement, leading the kernel to allocate a stub table with zero buckets. Although this stub table should not be visible to the data path, the old nexthop group may still be in use by the data path when the stub table is assigned, triggering a division by zero error. This error manifests as a kernel crash (divide error) and can cause a denial of service (DoS) by crashing the kernel or disrupting network traffic forwarding. The fix involves ensuring that the stub table is only assigned to the old nexthop group after confirming it is no longer used by the data path, preventing the division by zero condition. The vulnerability was tested with 222 passing tests and zero failures, indicating the fix's effectiveness. The vulnerability affects Linux kernel versions prior to the patch and is relevant to systems using resilient nexthop groups for multipath routing and traffic forwarding. No known exploits are reported in the wild, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to network infrastructure and servers running vulnerable Linux kernel versions that utilize resilient nexthop groups for routing. The division by zero error can lead to kernel panics and system crashes, resulting in denial of service conditions that disrupt network connectivity and critical services. This can affect data center operations, cloud service providers, telecom infrastructure, and enterprises relying on Linux-based routing or multipath forwarding. The impact on confidentiality and integrity is limited as this is not a direct code execution or privilege escalation vulnerability, but availability can be significantly affected. Organizations with high network traffic and complex routing setups are more susceptible. The lack of known exploits reduces immediate risk, but unpatched systems remain vulnerable to potential future attacks or accidental triggering of the bug through malformed routing configurations or stress testing. Given the widespread use of Linux in European IT infrastructure, the vulnerability could affect a broad range of sectors including finance, government, telecommunications, and critical infrastructure.

European organizations should promptly identify Linux systems running kernel versions affected by this vulnerability and apply the official patches provided by Linux kernel maintainers. Since the issue is in the kernel networking code, updating to the latest stable kernel release that includes the fix is essential. For environments where immediate patching is challenging, mitigating exposure by limiting the use of resilient nexthop groups or disabling multipath routing features temporarily can reduce risk. Network administrators should audit routing configurations to ensure no zero-bucket resilient nexthop groups are configured or in use. Monitoring kernel logs for divide errors or unusual network stack crashes can help detect attempts to trigger the vulnerability. Additionally, organizations should implement robust change management and testing procedures for kernel updates to avoid service disruptions. Coordination with Linux distribution vendors for timely security updates and applying those updates in a controlled manner is recommended. Finally, network segmentation and redundancy can help minimize the impact of potential DoS conditions caused by this vulnerability.