CVE-2021-47483 (GCVE-0-2021-47483)
Vulnerability from cvelistv5 – Published: 2024-05-22 08:19 – Updated: 2026-08-05 08:48
VLAI
EPSS
VEX
Title
regmap: Fix possible double-free in regcache_rbtree_exit()
Summary
In the Linux kernel, the following vulnerability has been resolved:
regmap: Fix possible double-free in regcache_rbtree_exit()
In regcache_rbtree_insert_to_block(), when 'present' realloc failed,
the 'blk' which is supposed to assign to 'rbnode->block' will be freed,
so 'rbnode->block' points a freed memory, in the error handling path of
regcache_rbtree_init(), 'rbnode->block' will be freed again in
regcache_rbtree_exit(), KASAN will report double-free as follows:
BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390
Call Trace:
slab_free_freelist_hook+0x10d/0x240
kfree+0xce/0x390
regcache_rbtree_exit+0x15d/0x1a0
regcache_rbtree_init+0x224/0x2c0
regcache_init+0x88d/0x1310
__regmap_init+0x3151/0x4a80
__devm_regmap_init+0x7d/0x100
madera_spi_probe+0x10f/0x333 [madera_spi]
spi_probe+0x183/0x210
really_probe+0x285/0xc30
To fix this, moving up the assignment of rbnode->block to immediately after
the reallocation has succeeded so that the data structure stays valid even
if the second reallocation fails.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:35 UTC
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
3f4ff561bc88b074d5e868dde4012d89cbb06c87 , < e72dce9afbdbfa70d9b44f5908a50ff6c4858999
(git)
Affected: 3f4ff561bc88b074d5e868dde4012d89cbb06c87 , < fc081477b47dfc3a6cb50a96087fc29674013fc2 (git) Affected: 3f4ff561bc88b074d5e868dde4012d89cbb06c87 , < 758ced2c3878ff789801e6fee808e185c5cf08d6 (git) Affected: 3f4ff561bc88b074d5e868dde4012d89cbb06c87 , < 3dae1a4eced3ee733d7222e69b8a55caf2d61091 (git) Affected: 3f4ff561bc88b074d5e868dde4012d89cbb06c87 , < 1cead23c1c0bc766dacb900a3b0269f651ad596f (git) Affected: 3f4ff561bc88b074d5e868dde4012d89cbb06c87 , < 36e911a16b377bde0ad91a8c679069d0d310b1a6 (git) Affected: 3f4ff561bc88b074d5e868dde4012d89cbb06c87 , < 50cc1462a668dc62949a1127388bc3af785ce047 (git) Affected: 3f4ff561bc88b074d5e868dde4012d89cbb06c87 , < 55e6d8037805b3400096d621091dfbf713f97e83 (git) |
guessed | |
| Linux | Linux |
Affected:
3.12
Unaffected: 0 , < 3.12 (semver) Unaffected: 4.4.291 , ≤ 4.4.* (semver) Unaffected: 4.9.289 , ≤ 4.9.* (semver) Unaffected: 4.14.254 , ≤ 4.14.* (semver) Unaffected: 4.19.215 , ≤ 4.19.* (semver) Unaffected: 5.4.157 , ≤ 5.4.* (semver) Unaffected: 5.10.77 , ≤ 5.10.* (semver) Unaffected: 5.14.16 , ≤ 5.14.* (semver) Unaffected: 5.15 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:39:59.752Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/e72dce9afbdbfa70d9b44f5908a50ff6c4858999"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/fc081477b47dfc3a6cb50a96087fc29674013fc2"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/758ced2c3878ff789801e6fee808e185c5cf08d6"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/3dae1a4eced3ee733d7222e69b8a55caf2d61091"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/1cead23c1c0bc766dacb900a3b0269f651ad596f"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/36e911a16b377bde0ad91a8c679069d0d310b1a6"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/50cc1462a668dc62949a1127388bc3af785ce047"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/55e6d8037805b3400096d621091dfbf713f97e83"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-47483",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T15:35:58.617398Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T17:32:53.194Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/base/regmap/regcache-rbtree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e72dce9afbdbfa70d9b44f5908a50ff6c4858999",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "fc081477b47dfc3a6cb50a96087fc29674013fc2",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "758ced2c3878ff789801e6fee808e185c5cf08d6",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "3dae1a4eced3ee733d7222e69b8a55caf2d61091",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "1cead23c1c0bc766dacb900a3b0269f651ad596f",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "36e911a16b377bde0ad91a8c679069d0d310b1a6",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "50cc1462a668dc62949a1127388bc3af785ce047",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "55e6d8037805b3400096d621091dfbf713f97e83",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/base/regmap/regcache-rbtree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.12"
},
{
"lessThan": "3.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.4.*",
"status": "unaffected",
"version": "4.4.291",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.289",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.254",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.215",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.14.*",
"status": "unaffected",
"version": "5.14.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.291",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.289",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.254",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.215",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.157",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.77",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.14.16",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15",
"versionStartIncluding": "3.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregmap: Fix possible double-free in regcache_rbtree_exit()\n\nIn regcache_rbtree_insert_to_block(), when \u0027present\u0027 realloc failed,\nthe \u0027blk\u0027 which is supposed to assign to \u0027rbnode-\u003eblock\u0027 will be freed,\nso \u0027rbnode-\u003eblock\u0027 points a freed memory, in the error handling path of\nregcache_rbtree_init(), \u0027rbnode-\u003eblock\u0027 will be freed again in\nregcache_rbtree_exit(), KASAN will report double-free as follows:\n\nBUG: KASAN: double-free or invalid-free in kfree+0xce/0x390\nCall Trace:\n slab_free_freelist_hook+0x10d/0x240\n kfree+0xce/0x390\n regcache_rbtree_exit+0x15d/0x1a0\n regcache_rbtree_init+0x224/0x2c0\n regcache_init+0x88d/0x1310\n __regmap_init+0x3151/0x4a80\n __devm_regmap_init+0x7d/0x100\n madera_spi_probe+0x10f/0x333 [madera_spi]\n spi_probe+0x183/0x210\n really_probe+0x285/0xc30\n\nTo fix this, moving up the assignment of rbnode-\u003eblock to immediately after\nthe reallocation has succeeded so that the data structure stays valid even\nif the second reallocation fails."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in regmap\u0027s local register cache (regcache_rbtree_insert_to_block), reached via driver probe/regmap init or local regmap writes through device interfaces (e.g. ASoC codecs), not by processing remote network payloads.\nAC:L - Triggering requires a GFP_KERNEL allocation failure on the second krealloc, but a local attacker can induce memory pressure to force that path; no victim state or attacker-uncontrollable race is required.\nPR:L - An unprivileged local user can drive regmap cache updates through widely deployed userspace-reachable device interfaces (notably ALSA/ASoC controls on systems with REGCACHE_RBTREE codecs) without needing root bind/module capabilities.\nUI:N - The attacker triggers the vulnerable path themselves via local operations and memory pressure; no separate victim action is required.\nS:U - Exploitation corrupts kernel heap memory within the same OS security authority (local privilege escalation), not a cross-boundary escape such as guest-to-host or IOMMU bypass.\nC:H - The dangling rbnode-\u003eblock after the failed realloc is a use-after-free/double-free primitive, which can be heap-groomed to obtain arbitrary kernel memory disclosure.\nI:H - Double-free/UAF on the cache block enables heap corruption suitable for arbitrary write and control-flow hijacking in the kernel.\nA:H - The double-free in regcache_rbtree_exit() (and UAF on later cache access) reliably causes kernel oops/panic or otherwise crashes the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T08:48:00.568Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e72dce9afbdbfa70d9b44f5908a50ff6c4858999"
},
{
"url": "https://git.kernel.org/stable/c/fc081477b47dfc3a6cb50a96087fc29674013fc2"
},
{
"url": "https://git.kernel.org/stable/c/758ced2c3878ff789801e6fee808e185c5cf08d6"
},
{
"url": "https://git.kernel.org/stable/c/3dae1a4eced3ee733d7222e69b8a55caf2d61091"
},
{
"url": "https://git.kernel.org/stable/c/1cead23c1c0bc766dacb900a3b0269f651ad596f"
},
{
"url": "https://git.kernel.org/stable/c/36e911a16b377bde0ad91a8c679069d0d310b1a6"
},
{
"url": "https://git.kernel.org/stable/c/50cc1462a668dc62949a1127388bc3af785ce047"
},
{
"url": "https://git.kernel.org/stable/c/55e6d8037805b3400096d621091dfbf713f97e83"
}
],
"title": "regmap: Fix possible double-free in regcache_rbtree_exit()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2021-47483",
"datePublished": "2024-05-22T08:19:34.852Z",
"dateReserved": "2024-05-22T06:20:56.200Z",
"dateUpdated": "2026-08-05T08:48:00.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2021-47483",
"date": "2026-11-01",
"epss": "0.00229",
"percentile": "0.13741"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/base/regmap/regcache-rbtree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e72dce9afbdbfa70d9b44f5908a50ff6c4858999",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "fc081477b47dfc3a6cb50a96087fc29674013fc2",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "758ced2c3878ff789801e6fee808e185c5cf08d6",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "3dae1a4eced3ee733d7222e69b8a55caf2d61091",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "1cead23c1c0bc766dacb900a3b0269f651ad596f",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "36e911a16b377bde0ad91a8c679069d0d310b1a6",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "50cc1462a668dc62949a1127388bc3af785ce047",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "55e6d8037805b3400096d621091dfbf713f97e83",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/base/regmap/regcache-rbtree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.12"
},
{
"lessThan": "3.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.4.*",
"status": "unaffected",
"version": "4.4.291",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.289",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.254",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.215",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.14.*",
"status": "unaffected",
"version": "5.14.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4C4E1787-4FA7-4459-8C03-4F7E0506D418",
"versionEndExcluding": "4.4.291",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3C36E651-9DAF-456A-BF26-911C6969C788",
"versionEndExcluding": "4.9.289",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E5B52B53-46CA-466D-A89D-BBB72ED073BF",
"versionEndExcluding": "4.14.254",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "254BE7BF-D39E-4928-A0AD-B6BBBCACF09C",
"versionEndExcluding": "4.19.215",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8FBCA21B-424F-4B7F-A9A8-FDD64FE6BD3B",
"versionEndExcluding": "5.4.157",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "26EB7ED9-AEA3-4829-8B5E-08571262F72A",
"versionEndExcluding": "5.10.77",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2681B950-4548-4649-A9E1-4124B59FC09C",
"versionEndExcluding": "5.14.16",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E46C74C6-B76B-4C94-A6A4-FD2FFF62D644",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*",
"matchCriteriaId": "60134C3A-06E4-48C1-B04F-2903732A4E56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*",
"matchCriteriaId": "0460DA88-8FE1-46A2-9DDA-1F1ABA552E71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*",
"matchCriteriaId": "AF55383D-4DF2-45DC-93F7-571F4F978EAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*",
"matchCriteriaId": "9E9481B2-8AA6-4CBD-B5D3-C10F51FF6D01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:*",
"matchCriteriaId": "EBD45831-4B79-42BC-ABC0-86870F0DEA89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.15:rc7:*:*:*:*:*:*",
"matchCriteriaId": "948A6B8D-1B72-4945-8680-354E53BE1C80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregmap: Fix possible double-free in regcache_rbtree_exit()\n\nIn regcache_rbtree_insert_to_block(), when \u0027present\u0027 realloc failed,\nthe \u0027blk\u0027 which is supposed to assign to \u0027rbnode-\u003eblock\u0027 will be freed,\nso \u0027rbnode-\u003eblock\u0027 points a freed memory, in the error handling path of\nregcache_rbtree_init(), \u0027rbnode-\u003eblock\u0027 will be freed again in\nregcache_rbtree_exit(), KASAN will report double-free as follows:\n\nBUG: KASAN: double-free or invalid-free in kfree+0xce/0x390\nCall Trace:\n slab_free_freelist_hook+0x10d/0x240\n kfree+0xce/0x390\n regcache_rbtree_exit+0x15d/0x1a0\n regcache_rbtree_init+0x224/0x2c0\n regcache_init+0x88d/0x1310\n __regmap_init+0x3151/0x4a80\n __devm_regmap_init+0x7d/0x100\n madera_spi_probe+0x10f/0x333 [madera_spi]\n spi_probe+0x183/0x210\n really_probe+0x285/0xc30\n\nTo fix this, moving up the assignment of rbnode-\u003eblock to immediately after\nthe reallocation has succeeded so that the data structure stays valid even\nif the second reallocation fails."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: regmap: corrige posible doble liberaci\u00f3n en regcache_rbtree_exit() En regcache_rbtree_insert_to_block(), cuando la realloc \u0027presente\u0027 fallaba, el \u0027blk\u0027 que se supone debe asignarse a \u0027rbnode-\u0026gt;block \u0027 se liberar\u00e1, por lo que \u0027rbnode-\u0026gt;block\u0027 apunta a una memoria liberada, en la ruta de manejo de errores de regcache_rbtree_init(), \u0027rbnode-\u0026gt;block\u0027 se liberar\u00e1 nuevamente en regcache_rbtree_exit(), KASAN informar\u00e1 la doble liberaci\u00f3n de la siguiente manera : ERROR: KASAN: doble libre o no v\u00e1lido en kfree+0xce/0x390 Rastreo de llamadas: slab_free_freelist_hook+0x10d/0x240 kfree+0xce/0x390 regcache_rbtree_exit+0x15d/0x1a0 regcache_rbtree_init+0x224/0x2c0 regcache_init+0x88d/ 0x1310 __regmap_init+0x3151/ 0x4a80 __devm_regmap_init+0x7d/0x100 madera_spi_probe+0x10f/0x333 [madera_spi] spi_probe+0x183/0x210 Actually_probe+0x285/0xc30 Para solucionar este problema, mueva hacia arriba la asignaci\u00f3n de rbnode-\u0026gt;block inmediatamente despu\u00e9s de que la reasignaci\u00f3n se haya realizado correctamente para que la estructura de datos permanezca v\u00e1lido incluso si la segunda reasignaci\u00f3n falla."
}
],
"id": "CVE-2021-47483",
"lastModified": "2026-08-04T10:17:05.090",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2021-47483",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T15:35:58.617398Z",
"version": "2.0.3"
}
}
]
},
"published": "2024-05-22T09:15:10.227",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/1cead23c1c0bc766dacb900a3b0269f651ad596f"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/36e911a16b377bde0ad91a8c679069d0d310b1a6"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/3dae1a4eced3ee733d7222e69b8a55caf2d61091"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/50cc1462a668dc62949a1127388bc3af785ce047"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/55e6d8037805b3400096d621091dfbf713f97e83"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/758ced2c3878ff789801e6fee808e185c5cf08d6"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/e72dce9afbdbfa70d9b44f5908a50ff6c4858999"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/fc081477b47dfc3a6cb50a96087fc29674013fc2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/1cead23c1c0bc766dacb900a3b0269f651ad596f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/36e911a16b377bde0ad91a8c679069d0d310b1a6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/3dae1a4eced3ee733d7222e69b8a55caf2d61091"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/50cc1462a668dc62949a1127388bc3af785ce047"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/55e6d8037805b3400096d621091dfbf713f97e83"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/758ced2c3878ff789801e6fee808e185c5cf08d6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/e72dce9afbdbfa70d9b44f5908a50ff6c4858999"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/fc081477b47dfc3a6cb50a96087fc29674013fc2"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-415"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Low",
"current_release_date": "2026-10-30T01:25:51+00:00",
"cve": "CVE-2021-47483",
"id": "CVE-2021-47483",
"initial_release_date": "2021-01-01T00:00:00+00:00",
"product_status:fixed": "120",
"product_status:known_affected": "153",
"product_status:known_not_affected": "14",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: regmap: Fix possible double-free in regcache_rbtree_exit()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47483.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:39:59.752Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/e72dce9afbdbfa70d9b44f5908a50ff6c4858999"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/fc081477b47dfc3a6cb50a96087fc29674013fc2"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/758ced2c3878ff789801e6fee808e185c5cf08d6"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/3dae1a4eced3ee733d7222e69b8a55caf2d61091"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/1cead23c1c0bc766dacb900a3b0269f651ad596f"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/36e911a16b377bde0ad91a8c679069d0d310b1a6"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/50cc1462a668dc62949a1127388bc3af785ce047"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/55e6d8037805b3400096d621091dfbf713f97e83"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-47483",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T15:35:58.617398Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T12:42:13.248Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/base/regmap/regcache-rbtree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e72dce9afbdbfa70d9b44f5908a50ff6c4858999",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "fc081477b47dfc3a6cb50a96087fc29674013fc2",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "758ced2c3878ff789801e6fee808e185c5cf08d6",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "3dae1a4eced3ee733d7222e69b8a55caf2d61091",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "1cead23c1c0bc766dacb900a3b0269f651ad596f",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "36e911a16b377bde0ad91a8c679069d0d310b1a6",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "50cc1462a668dc62949a1127388bc3af785ce047",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
},
{
"lessThan": "55e6d8037805b3400096d621091dfbf713f97e83",
"status": "affected",
"version": "3f4ff561bc88b074d5e868dde4012d89cbb06c87",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/base/regmap/regcache-rbtree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.12"
},
{
"lessThan": "3.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.4.*",
"status": "unaffected",
"version": "4.4.291",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.289",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.254",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.215",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.14.*",
"status": "unaffected",
"version": "5.14.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.291",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.289",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.254",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.215",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.157",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.77",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.14.16",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15",
"versionStartIncluding": "3.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregmap: Fix possible double-free in regcache_rbtree_exit()\n\nIn regcache_rbtree_insert_to_block(), when \u0027present\u0027 realloc failed,\nthe \u0027blk\u0027 which is supposed to assign to \u0027rbnode-\u003eblock\u0027 will be freed,\nso \u0027rbnode-\u003eblock\u0027 points a freed memory, in the error handling path of\nregcache_rbtree_init(), \u0027rbnode-\u003eblock\u0027 will be freed again in\nregcache_rbtree_exit(), KASAN will report double-free as follows:\n\nBUG: KASAN: double-free or invalid-free in kfree+0xce/0x390\nCall Trace:\n slab_free_freelist_hook+0x10d/0x240\n kfree+0xce/0x390\n regcache_rbtree_exit+0x15d/0x1a0\n regcache_rbtree_init+0x224/0x2c0\n regcache_init+0x88d/0x1310\n __regmap_init+0x3151/0x4a80\n __devm_regmap_init+0x7d/0x100\n madera_spi_probe+0x10f/0x333 [madera_spi]\n spi_probe+0x183/0x210\n really_probe+0x285/0xc30\n\nTo fix this, moving up the assignment of rbnode-\u003eblock to immediately after\nthe reallocation has succeeded so that the data structure stays valid even\nif the second reallocation fails."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in regmap\u0027s local register cache (regcache_rbtree_insert_to_block), reached via driver probe/regmap init or local regmap writes through device interfaces (e.g. ASoC codecs), not by processing remote network payloads.\nAC:L - Triggering requires a GFP_KERNEL allocation failure on the second krealloc, but a local attacker can induce memory pressure to force that path; no victim state or attacker-uncontrollable race is required.\nPR:L - An unprivileged local user can drive regmap cache updates through widely deployed userspace-reachable device interfaces (notably ALSA/ASoC controls on systems with REGCACHE_RBTREE codecs) without needing root bind/module capabilities.\nUI:N - The attacker triggers the vulnerable path themselves via local operations and memory pressure; no separate victim action is required.\nS:U - Exploitation corrupts kernel heap memory within the same OS security authority (local privilege escalation), not a cross-boundary escape such as guest-to-host or IOMMU bypass.\nC:H - The dangling rbnode-\u003eblock after the failed realloc is a use-after-free/double-free primitive, which can be heap-groomed to obtain arbitrary kernel memory disclosure.\nI:H - Double-free/UAF on the cache block enables heap corruption suitable for arbitrary write and control-flow hijacking in the kernel.\nA:H - The double-free in regcache_rbtree_exit() (and UAF on later cache access) reliably causes kernel oops/panic or otherwise crashes the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T08:48:00.568Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e72dce9afbdbfa70d9b44f5908a50ff6c4858999"
},
{
"url": "https://git.kernel.org/stable/c/fc081477b47dfc3a6cb50a96087fc29674013fc2"
},
{
"url": "https://git.kernel.org/stable/c/758ced2c3878ff789801e6fee808e185c5cf08d6"
},
{
"url": "https://git.kernel.org/stable/c/3dae1a4eced3ee733d7222e69b8a55caf2d61091"
},
{
"url": "https://git.kernel.org/stable/c/1cead23c1c0bc766dacb900a3b0269f651ad596f"
},
{
"url": "https://git.kernel.org/stable/c/36e911a16b377bde0ad91a8c679069d0d310b1a6"
},
{
"url": "https://git.kernel.org/stable/c/50cc1462a668dc62949a1127388bc3af785ce047"
},
{
"url": "https://git.kernel.org/stable/c/55e6d8037805b3400096d621091dfbf713f97e83"
}
],
"title": "regmap: Fix possible double-free in regcache_rbtree_exit()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2021-47483",
"datePublished": "2024-05-22T08:19:34.852Z",
"dateReserved": "2024-05-22T06:20:56.200Z",
"dateUpdated": "2026-08-05T08:48:00.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.