boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2021-47160HIGH
Linux Linux — net: dsa: mt7530: fix VLAN traffic leaks
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  N  H    7.1   .0033   26.0     —
AFFECTED
  Product  Versions                                    Fixed
  Linux    83163f7dca5684816d01c8ccf4857aa74801e7b7 –  —
  Linux    4.16 –                                      4.19.193
TIMELINE
  Mar 25  Reserved by Linux
  Mar 25  Published (CNA: Linux)
  Aug 4   RESCORED — CVE-2021-47160 (Linux). CVSS 8.1 → 7.1 (NVD).
CNA: Linux · CVSS v3.1 · 5 references · NVD status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix VLAN traffic leaks PCR_MATRIX field was set to all 1's when VLAN filtering is enabled, but was not reset when it is disabled, which may cause traffic leaks: ip link add br0 type bridge vlan_filtering 1 ip link add br1 type bridge vlan_filtering 1 ip link set swp0 master br0 ip link set swp1 master br1 ip link set br0 type bridge vlan_filtering 0 ip link set br1 type bridge vlan_filtering 0 # traffic in br0 and br1 will start leaking to each other As port_bridge_{add,del} have set up PCR_MATRIX properly, remove the PCR_MATRIX write from mt7530_port_set_vlan_aware.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
March 25, 2024ReservedReserved by Linux
March 25, 2024PublishedPublished (CNA: Linux)
August 4, 2026RESCOREDRESCORED — CVE-2021-47160 (Linux). CVSS 8.1 → 7.1 (NVD).

Affected

Affected products and packages — 2 rows
VendorProduct / PackageEcosystemVersion introducedFixed
LinuxLinux83163f7dca5684816d01c8ccf4857aa74801e7b7
LinuxLinux4.164.19.193

References (5)

Related

Authoritative record: CVE-2021-47160 at cve.org

Vendors: linux

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-47160 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.