CVE-2021-47412 (GCVE-0-2021-47412)
Vulnerability from cvelistv5 – Published: 2024-05-21 15:04 – Updated: 2026-08-05 08:47
VLAI
EPSS
VEX
Title
block: don't call rq_qos_ops->done_bio if the bio isn't tracked
Summary
In the Linux kernel, the following vulnerability has been resolved:
block: don't call rq_qos_ops->done_bio if the bio isn't tracked
rq_qos framework is only applied on request based driver, so:
1) rq_qos_done_bio() needn't to be called for bio based driver
2) rq_qos_done_bio() needn't to be called for bio which isn't tracked,
such as bios ended from error handling code.
Especially in bio_endio():
1) request queue is referred via bio->bi_bdev->bd_disk->queue, which
may be gone since request queue refcount may not be held in above two
cases
2) q->rq_qos may be freed in blk_cleanup_queue() when calling into
__rq_qos_done_bio()
Fix the potential kernel panic by not calling rq_qos_ops->done_bio if
the bio isn't tracked. This way is safe because both ioc_rqos_done_bio()
and blkcg_iolatency_done_bio() are nop if the bio isn't tracked.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-11 17:28 UTC
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578 , < db60edbfff332a6a5477c367af8125f034570989
(git)
Affected: 67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578 , < 004b8f8a691205a93d9e80d98b786b2b97424d6e (git) Affected: 67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578 , < a647a524a46736786c95cdb553a070322ca096e3 (git) |
guessed | |
| Linux | Linux |
Affected:
4.19
Unaffected: 0 , < 4.19 (semver) Unaffected: 5.10.241 , ≤ 5.10.* (semver) Unaffected: 5.14.11 , ≤ 5.14.* (semver) Unaffected: 5.15 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-47412",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-11T17:28:47.066559Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-11T17:29:00.823Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T17:30:56.004Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/004b8f8a691205a93d9e80d98b786b2b97424d6e"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/a647a524a46736786c95cdb553a070322ca096e3"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/bio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "db60edbfff332a6a5477c367af8125f034570989",
"status": "affected",
"version": "67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578",
"versionType": "git"
},
{
"lessThan": "004b8f8a691205a93d9e80d98b786b2b97424d6e",
"status": "affected",
"version": "67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578",
"versionType": "git"
},
{
"lessThan": "a647a524a46736786c95cdb553a070322ca096e3",
"status": "affected",
"version": "67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/bio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.241",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.14.*",
"status": "unaffected",
"version": "5.14.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.241",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.14.11",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: don\u0027t call rq_qos_ops-\u003edone_bio if the bio isn\u0027t tracked\n\nrq_qos framework is only applied on request based driver, so:\n\n1) rq_qos_done_bio() needn\u0027t to be called for bio based driver\n\n2) rq_qos_done_bio() needn\u0027t to be called for bio which isn\u0027t tracked,\nsuch as bios ended from error handling code.\n\nEspecially in bio_endio():\n\n1) request queue is referred via bio-\u003ebi_bdev-\u003ebd_disk-\u003equeue, which\nmay be gone since request queue refcount may not be held in above two\ncases\n\n2) q-\u003erq_qos may be freed in blk_cleanup_queue() when calling into\n__rq_qos_done_bio()\n\nFix the potential kernel panic by not calling rq_qos_ops-\u003edone_bio if\nthe bio isn\u0027t tracked. This way is safe because both ioc_rqos_done_bio()\nand blkcg_iolatency_done_bio() are nop if the bio isn\u0027t tracked."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in block-layer bio_endio()/rq_qos_done_bio(), reached by local I/O submission (syscalls to a block device or filesystem on it) racing device/queue teardown, not by parsing remote protocol packets.\nAC:L - An attacker who can issue concurrent I/O and induce queue teardown (e.g. write to removable/loop/NBD media then eject/disconnect) controls both sides of the race; rq_qos_done_bio() has no lock versus rq_qos_exit(), so the UAF is reliably triggerable.\nPR:L - Unprivileged local users can write to user-accessible block devices (removable media, permitted loop/NBD nodes) and trigger teardown via eject/unmount paths available to the mounting user; root in the init namespace is not required.\nUI:N - The attacker performs the I/O and device teardown/eject themselves; no separate victim action is required.\nS:U - Impact is confined to the host kernel (UAF/panic or local privilege escalation) and does not cross a VM, IOMMU, or other security authority boundary.\nC:H - rq_qos_exit() frees rq_qos objects while bio_endio() may still load q-\u003erq_qos and walk rqos-\u003eops/next on reallocated slab memory, giving an attacker-controlled UAF read primitive.\nI:H - __rq_qos_done_bio() invokes rqos-\u003eops-\u003edone_bio on the freed object, so heap reuse can hijack the function pointer for arbitrary write / control-flow hijacking, not merely a crash.\nA:H - The same UAF produces kernel oops/panic when done_bio runs against freed rq_qos or a freed request_queue, fully impacting availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T08:47:43.235Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/db60edbfff332a6a5477c367af8125f034570989"
},
{
"url": "https://git.kernel.org/stable/c/004b8f8a691205a93d9e80d98b786b2b97424d6e"
},
{
"url": "https://git.kernel.org/stable/c/a647a524a46736786c95cdb553a070322ca096e3"
}
],
"title": "block: don\u0027t call rq_qos_ops-\u003edone_bio if the bio isn\u0027t tracked",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2021-47412",
"datePublished": "2024-05-21T15:04:03.309Z",
"dateReserved": "2024-05-21T14:58:30.817Z",
"dateUpdated": "2026-08-05T08:47:43.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2021-47412",
"date": "2026-11-04",
"epss": "0.00233",
"percentile": "0.14335"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/bio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "db60edbfff332a6a5477c367af8125f034570989",
"status": "affected",
"version": "67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578",
"versionType": "git"
},
{
"lessThan": "004b8f8a691205a93d9e80d98b786b2b97424d6e",
"status": "affected",
"version": "67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578",
"versionType": "git"
},
{
"lessThan": "a647a524a46736786c95cdb553a070322ca096e3",
"status": "affected",
"version": "67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/bio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.241",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.14.*",
"status": "unaffected",
"version": "5.14.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AC788FBF-3063-4B89-9406-EA698F0B9B1C",
"versionEndExcluding": "5.10.241",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9E845F47-DE3A-41CF-BB74-007A8AF3E47C",
"versionEndExcluding": "5.14.11",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E46C74C6-B76B-4C94-A6A4-FD2FFF62D644",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*",
"matchCriteriaId": "60134C3A-06E4-48C1-B04F-2903732A4E56",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: don\u0027t call rq_qos_ops-\u003edone_bio if the bio isn\u0027t tracked\n\nrq_qos framework is only applied on request based driver, so:\n\n1) rq_qos_done_bio() needn\u0027t to be called for bio based driver\n\n2) rq_qos_done_bio() needn\u0027t to be called for bio which isn\u0027t tracked,\nsuch as bios ended from error handling code.\n\nEspecially in bio_endio():\n\n1) request queue is referred via bio-\u003ebi_bdev-\u003ebd_disk-\u003equeue, which\nmay be gone since request queue refcount may not be held in above two\ncases\n\n2) q-\u003erq_qos may be freed in blk_cleanup_queue() when calling into\n__rq_qos_done_bio()\n\nFix the potential kernel panic by not calling rq_qos_ops-\u003edone_bio if\nthe bio isn\u0027t tracked. This way is safe because both ioc_rqos_done_bio()\nand blkcg_iolatency_done_bio() are nop if the bio isn\u0027t tracked."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bloque: no llame a rq_qos_ops-\u0026gt;done_bio si no se realiza un seguimiento de la biograf\u00eda. El framework rq_qos solo se aplica en el controlador basado en solicitudes, por lo que: 1) rq_qos_done_bio() no necesita hacerlo ser llamado para un controlador basado en biograf\u00eda 2) No es necesario llamar a rq_qos_done_bio() para una biograf\u00eda que no est\u00e1 rastreada, como una biograf\u00eda terminada por un c\u00f3digo de manejo de errores. Especialmente en bio_endio(): 1) la cola de solicitudes se remite a trav\u00e9s de bio-\u0026gt;bi_bdev-\u0026gt;bd_disk-\u0026gt;queue, que puede desaparecer ya que el recuento de la cola de solicitudes no se puede mantener en los dos casos anteriores 2) q-\u0026gt;rq_qos se puede liberar en blk_cleanup_queue() al llamar a __rq_qos_done_bio() Solucione el posible p\u00e1nico del kernel al no llamar a rq_qos_ops-\u0026gt;done_bio si no se realiza un seguimiento de la biograf\u00eda. Esta forma es segura porque tanto ioc_rqos_done_bio() como blkcg_iolatency_done_bio() no funcionan si no se realiza un seguimiento de la biograf\u00eda."
}
],
"id": "CVE-2021-47412",
"lastModified": "2026-08-04T10:17:02.490",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2021-47412",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-11T17:28:47.066559Z",
"version": "2.0.3"
}
}
]
},
"published": "2024-05-21T15:15:26.700",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/004b8f8a691205a93d9e80d98b786b2b97424d6e"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/a647a524a46736786c95cdb553a070322ca096e3"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/db60edbfff332a6a5477c367af8125f034570989"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/004b8f8a691205a93d9e80d98b786b2b97424d6e"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/a647a524a46736786c95cdb553a070322ca096e3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-10-30T18:16:33+00:00",
"cve": "CVE-2021-47412",
"id": "CVE-2021-47412",
"initial_release_date": "2021-01-01T00:00:00+00:00",
"product_status:fixed": "212",
"product_status:known_not_affected": "151",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: block: don\u0027t call rq_qos_ops-\u003edone_bio if the bio isn\u0027t tracked",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47412.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-03T17:30:56.004Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/004b8f8a691205a93d9e80d98b786b2b97424d6e"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/a647a524a46736786c95cdb553a070322ca096e3"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-47412",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-11T17:28:47.066559Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-11T17:28:53.752Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/bio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "db60edbfff332a6a5477c367af8125f034570989",
"status": "affected",
"version": "67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578",
"versionType": "git"
},
{
"lessThan": "004b8f8a691205a93d9e80d98b786b2b97424d6e",
"status": "affected",
"version": "67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578",
"versionType": "git"
},
{
"lessThan": "a647a524a46736786c95cdb553a070322ca096e3",
"status": "affected",
"version": "67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/bio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.241",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.14.*",
"status": "unaffected",
"version": "5.14.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.241",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.14.11",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: don\u0027t call rq_qos_ops-\u003edone_bio if the bio isn\u0027t tracked\n\nrq_qos framework is only applied on request based driver, so:\n\n1) rq_qos_done_bio() needn\u0027t to be called for bio based driver\n\n2) rq_qos_done_bio() needn\u0027t to be called for bio which isn\u0027t tracked,\nsuch as bios ended from error handling code.\n\nEspecially in bio_endio():\n\n1) request queue is referred via bio-\u003ebi_bdev-\u003ebd_disk-\u003equeue, which\nmay be gone since request queue refcount may not be held in above two\ncases\n\n2) q-\u003erq_qos may be freed in blk_cleanup_queue() when calling into\n__rq_qos_done_bio()\n\nFix the potential kernel panic by not calling rq_qos_ops-\u003edone_bio if\nthe bio isn\u0027t tracked. This way is safe because both ioc_rqos_done_bio()\nand blkcg_iolatency_done_bio() are nop if the bio isn\u0027t tracked."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in block-layer bio_endio()/rq_qos_done_bio(), reached by local I/O submission (syscalls to a block device or filesystem on it) racing device/queue teardown, not by parsing remote protocol packets.\nAC:L - An attacker who can issue concurrent I/O and induce queue teardown (e.g. write to removable/loop/NBD media then eject/disconnect) controls both sides of the race; rq_qos_done_bio() has no lock versus rq_qos_exit(), so the UAF is reliably triggerable.\nPR:L - Unprivileged local users can write to user-accessible block devices (removable media, permitted loop/NBD nodes) and trigger teardown via eject/unmount paths available to the mounting user; root in the init namespace is not required.\nUI:N - The attacker performs the I/O and device teardown/eject themselves; no separate victim action is required.\nS:U - Impact is confined to the host kernel (UAF/panic or local privilege escalation) and does not cross a VM, IOMMU, or other security authority boundary.\nC:H - rq_qos_exit() frees rq_qos objects while bio_endio() may still load q-\u003erq_qos and walk rqos-\u003eops/next on reallocated slab memory, giving an attacker-controlled UAF read primitive.\nI:H - __rq_qos_done_bio() invokes rqos-\u003eops-\u003edone_bio on the freed object, so heap reuse can hijack the function pointer for arbitrary write / control-flow hijacking, not merely a crash.\nA:H - The same UAF produces kernel oops/panic when done_bio runs against freed rq_qos or a freed request_queue, fully impacting availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T08:47:43.235Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/db60edbfff332a6a5477c367af8125f034570989"
},
{
"url": "https://git.kernel.org/stable/c/004b8f8a691205a93d9e80d98b786b2b97424d6e"
},
{
"url": "https://git.kernel.org/stable/c/a647a524a46736786c95cdb553a070322ca096e3"
}
],
"title": "block: don\u0027t call rq_qos_ops-\u003edone_bio if the bio isn\u0027t tracked",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2021-47412",
"datePublished": "2024-05-21T15:04:03.309Z",
"dateReserved": "2024-05-21T14:58:30.817Z",
"dateUpdated": "2026-08-05T08:47:43.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.