CVE-2021-47130 (GCVE-0-2021-47130)

Vulnerability from cvelistv5 – Published: 2024-03-15 20:14 – Updated: 2026-08-05 08:46
VLAI
Title
nvmet: fix freeing unallocated p2pmem
Summary
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix freeing unallocated p2pmem In case p2p device was found but the p2p pool is empty, the nvme target is still trying to free the sgl from the p2p pool instead of the regular sgl pool and causing a crash (BUG() is called). Instead, assign the p2p_dev for the request only if it was allocated from p2p pool. This is the crash that was caused: [Sun May 30 19:13:53 2021] ------------[ cut here ]------------ [Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518! [Sun May 30 19:13:53 2021] invalid opcode: 0000 [#1] SMP PTI ... [Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518! ... [Sun May 30 19:13:53 2021] RIP: 0010:gen_pool_free_owner+0xa8/0xb0 ... [Sun May 30 19:13:53 2021] Call Trace: [Sun May 30 19:13:53 2021] ------------[ cut here ]------------ [Sun May 30 19:13:53 2021] pci_free_p2pmem+0x2b/0x70 [Sun May 30 19:13:53 2021] pci_p2pmem_free_sgl+0x4f/0x80 [Sun May 30 19:13:53 2021] nvmet_req_free_sgls+0x1e/0x80 [nvmet] [Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518! [Sun May 30 19:13:53 2021] nvmet_rdma_release_rsp+0x4e/0x1f0 [nvmet_rdma] [Sun May 30 19:13:53 2021] nvmet_rdma_send_done+0x1c/0x60 [nvmet_rdma]
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-03-18 15:12 UTC
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c6e3f13398123a008cd2ee28f93510b113a32791 , < c440cd080761b18a52cac20f2a42e5da1e3995af (git)
Affected: c6e3f13398123a008cd2ee28f93510b113a32791 , < 8a452d62e7cea3c8a2676a3b89a9118755a1a271 (git)
Affected: c6e3f13398123a008cd2ee28f93510b113a32791 , < bcd9a0797d73eeff659582f23277e7ab6e5f18f3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 5.10.43 , ≤ 5.10.* (semver)
Unaffected: 5.12.10 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 4.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47130",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T15:12:36.061889Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-04T17:09:52.222Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:39.944Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c440cd080761b18a52cac20f2a42e5da1e3995af"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8a452d62e7cea3c8a2676a3b89a9118755a1a271"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bcd9a0797d73eeff659582f23277e7ab6e5f18f3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c440cd080761b18a52cac20f2a42e5da1e3995af",
              "status": "affected",
              "version": "c6e3f13398123a008cd2ee28f93510b113a32791",
              "versionType": "git"
            },
            {
              "lessThan": "8a452d62e7cea3c8a2676a3b89a9118755a1a271",
              "status": "affected",
              "version": "c6e3f13398123a008cd2ee28f93510b113a32791",
              "versionType": "git"
            },
            {
              "lessThan": "bcd9a0797d73eeff659582f23277e7ab6e5f18f3",
              "status": "affected",
              "version": "c6e3f13398123a008cd2ee28f93510b113a32791",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.43",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.10",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix freeing unallocated p2pmem\n\nIn case p2p device was found but the p2p pool is empty, the nvme target\nis still trying to free the sgl from the p2p pool instead of the\nregular sgl pool and causing a crash (BUG() is called). Instead, assign\nthe p2p_dev for the request only if it was allocated from p2p pool.\n\nThis is the crash that was caused:\n\n[Sun May 30 19:13:53 2021] ------------[ cut here ]------------\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\n[Sun May 30 19:13:53 2021] invalid opcode: 0000 [#1] SMP PTI\n...\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\n...\n[Sun May 30 19:13:53 2021] RIP: 0010:gen_pool_free_owner+0xa8/0xb0\n...\n[Sun May 30 19:13:53 2021] Call Trace:\n[Sun May 30 19:13:53 2021] ------------[ cut here ]------------\n[Sun May 30 19:13:53 2021]  pci_free_p2pmem+0x2b/0x70\n[Sun May 30 19:13:53 2021]  pci_p2pmem_free_sgl+0x4f/0x80\n[Sun May 30 19:13:53 2021]  nvmet_req_free_sgls+0x1e/0x80 [nvmet]\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\n[Sun May 30 19:13:53 2021]  nvmet_rdma_release_rsp+0x4e/0x1f0 [nvmet_rdma]\n[Sun May 30 19:13:53 2021]  nvmet_rdma_send_done+0x1c/0x60 [nvmet_rdma]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The buggy SGL alloc/free path is reached only from nvmet-rdma (`nvmet_rdma_map_sgl_keyed` \u2192 `nvmet_req_alloc_sgls` / `nvmet_rdma_release_rsp` \u2192 `nvmet_req_free_sgls`), which processes NVMe-oF commands from a remote RDMA/RoCE peer over the network.\nAC:L - In a p2pmem-enabled target deployment, an attacker who can issue I/O controls transfer size and concurrency and can force `pci_p2pmem_alloc_sgl()` to fail so the regular SGL fallback runs with `req-\u003ep2p_dev` still set; the subsequent free reliably hits `BUG()` in `gen_pool_free_owner()`.\nPR:N - At this vintage there was no DH-CHAP in-band auth, and with `allow_any_host` (a common nvmet config) any network peer can CONNECT and issue I/O; host NQN allowlisting alone is not a credential check, so this matches unauthenticated nvmet DoS scoring (e.g. CVE-2026-22998).\nUI:N - No victim user action is required once the NVMe target is configured and listening; the attacker only needs to connect and send I/O that exercises the p2pmem fallback path.\nS:U - Impact is a kernel BUG/oops in the same host kernel authority as the nvmet target; this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:N - The defect frees a regular SGL through the p2pmem free path and terminates in `BUG()` when the address is not in the p2p gen_pool; it does not disclose kernel memory.\nI:N - This is a wrong-allocator free that hits an intentional `BUG()` rather than a use-after-free, OOB write, or other memory-corruption primitive usable for integrity compromise or code execution.\nA:H - Successful trigger causes `kernel BUG at lib/genalloc.c` (`gen_pool_free_owner`), producing a kernel oops/panic and denial of service of the target host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:12.154Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c440cd080761b18a52cac20f2a42e5da1e3995af"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a452d62e7cea3c8a2676a3b89a9118755a1a271"
        },
        {
          "url": "https://git.kernel.org/stable/c/bcd9a0797d73eeff659582f23277e7ab6e5f18f3"
        }
      ],
      "title": "nvmet: fix freeing unallocated p2pmem",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47130",
    "datePublished": "2024-03-15T20:14:33.955Z",
    "dateReserved": "2024-03-04T18:12:48.840Z",
    "dateUpdated": "2026-08-05T08:46:12.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47130",
      "date": "2026-08-17",
      "epss": "0.00639",
      "percentile": "0.47662"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvmet: fix freeing unallocated p2pmem\\n\\nIn case p2p device was found but the p2p pool is empty, the nvme target\\nis still trying to free the sgl from the p2p pool instead of the\\nregular sgl pool and causing a crash (BUG() is called). Instead, assign\\nthe p2p_dev for the request only if it was allocated from p2p pool.\\n\\nThis is the crash that was caused:\\n\\n[Sun May 30 19:13:53 2021] ------------[ cut here ]------------\\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\\n[Sun May 30 19:13:53 2021] invalid opcode: 0000 [#1] SMP PTI\\n...\\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\\n...\\n[Sun May 30 19:13:53 2021] RIP: 0010:gen_pool_free_owner+0xa8/0xb0\\n...\\n[Sun May 30 19:13:53 2021] Call Trace:\\n[Sun May 30 19:13:53 2021] ------------[ cut here ]------------\\n[Sun May 30 19:13:53 2021]  pci_free_p2pmem+0x2b/0x70\\n[Sun May 30 19:13:53 2021]  pci_p2pmem_free_sgl+0x4f/0x80\\n[Sun May 30 19:13:53 2021]  nvmet_req_free_sgls+0x1e/0x80 [nvmet]\\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\\n[Sun May 30 19:13:53 2021]  nvmet_rdma_release_rsp+0x4e/0x1f0 [nvmet_rdma]\\n[Sun May 30 19:13:53 2021]  nvmet_rdma_send_done+0x1c/0x60 [nvmet_rdma]\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: nvmet: soluci\\u00f3n que libera p2pmem no asignado En caso de que se encuentre un dispositivo p2p pero el grupo p2p est\\u00e9 vac\\u00edo, el objetivo nvme todav\\u00eda est\\u00e1 intentando liberar el sgl del grupo p2p en lugar del sgl normal. pool y provocando un bloqueo (se llama a BUG()). En su lugar, asigne p2p_dev para la solicitud solo si se asign\\u00f3 desde el grupo p2p. Este es el accidente que se provoc\\u00f3: [domingo 30 de mayo 19:13:53 2021] ------------[ cortar aqu\\u00ed ]------------ [domingo de mayo 30 19:13:53 2021] \\u00a1ERROR del kernel en lib/genalloc.c:518! [domingo 30 de mayo 19:13:53 2021] c\\u00f3digo de operaci\\u00f3n no v\\u00e1lido: 0000 [#1] SMP PTI... [domingo 30 de mayo 19:13:53 2021] ERROR del kernel en lib/genalloc.c:518. ... [dom 30 de mayo 19:13:53 2021] RIP: 0010:gen_pool_free_owner+0xa8/0xb0 ... [dom 30 de mayo 19:13:53 2021] Seguimiento de llamadas: [dom 30 de mayo 19:13:53 2021 ] ------------[ cortar aqu\\u00ed ]------------ [domingo 30 de mayo 19:13:53 2021] pci_free_p2pmem+0x2b/0x70 [domingo 30 de mayo 19 :13:53 2021] pci_p2pmem_free_sgl+0x4f/0x80 [domingo 30 de mayo 19:13:53 2021] nvmet_req_free_sgls+0x1e/0x80 [nvmet] [domingo 30 de mayo 19:13:53 2021] ERROR del kernel en lib/genalloc.c: 518! [dom 30 de mayo 19:13:53 2021] nvmet_rdma_release_rsp+0x4e/0x1f0 [nvmet_rdma] [dom 30 de mayo 19:13:53 2021] nvmet_rdma_send_done+0x1c/0x60 [nvmet_rdma]\"}]",
      "id": "CVE-2021-47130",
      "lastModified": "2024-11-21T06:35:27.503",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 4.4, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 0.8, \"impactScore\": 3.6}]}",
      "published": "2024-03-15T21:15:07.577",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/8a452d62e7cea3c8a2676a3b89a9118755a1a271\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/bcd9a0797d73eeff659582f23277e7ab6e5f18f3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c440cd080761b18a52cac20f2a42e5da1e3995af\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/8a452d62e7cea3c8a2676a3b89a9118755a1a271\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/bcd9a0797d73eeff659582f23277e7ab6e5f18f3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/c440cd080761b18a52cac20f2a42e5da1e3995af\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47130\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-03-15T21:15:07.577\",\"lastModified\":\"2026-08-04T10:16:47.630\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvmet: fix freeing unallocated p2pmem\\n\\nIn case p2p device was found but the p2p pool is empty, the nvme target\\nis still trying to free the sgl from the p2p pool instead of the\\nregular sgl pool and causing a crash (BUG() is called). Instead, assign\\nthe p2p_dev for the request only if it was allocated from p2p pool.\\n\\nThis is the crash that was caused:\\n\\n[Sun May 30 19:13:53 2021] ------------[ cut here ]------------\\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\\n[Sun May 30 19:13:53 2021] invalid opcode: 0000 [#1] SMP PTI\\n...\\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\\n...\\n[Sun May 30 19:13:53 2021] RIP: 0010:gen_pool_free_owner+0xa8/0xb0\\n...\\n[Sun May 30 19:13:53 2021] Call Trace:\\n[Sun May 30 19:13:53 2021] ------------[ cut here ]------------\\n[Sun May 30 19:13:53 2021]  pci_free_p2pmem+0x2b/0x70\\n[Sun May 30 19:13:53 2021]  pci_p2pmem_free_sgl+0x4f/0x80\\n[Sun May 30 19:13:53 2021]  nvmet_req_free_sgls+0x1e/0x80 [nvmet]\\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\\n[Sun May 30 19:13:53 2021]  nvmet_rdma_release_rsp+0x4e/0x1f0 [nvmet_rdma]\\n[Sun May 30 19:13:53 2021]  nvmet_rdma_send_done+0x1c/0x60 [nvmet_rdma]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: nvmet: soluci\u00f3n que libera p2pmem no asignado En caso de que se encuentre un dispositivo p2p pero el grupo p2p est\u00e9 vac\u00edo, el objetivo nvme todav\u00eda est\u00e1 intentando liberar el sgl del grupo p2p en lugar del sgl normal. pool y provocando un bloqueo (se llama a BUG()). En su lugar, asigne p2p_dev para la solicitud solo si se asign\u00f3 desde el grupo p2p. Este es el accidente que se provoc\u00f3: [domingo 30 de mayo 19:13:53 2021] ------------[ cortar aqu\u00ed ]------------ [domingo de mayo 30 19:13:53 2021] \u00a1ERROR del kernel en lib/genalloc.c:518! [domingo 30 de mayo 19:13:53 2021] c\u00f3digo de operaci\u00f3n no v\u00e1lido: 0000 [#1] SMP PTI... [domingo 30 de mayo 19:13:53 2021] ERROR del kernel en lib/genalloc.c:518. ... [dom 30 de mayo 19:13:53 2021] RIP: 0010:gen_pool_free_owner+0xa8/0xb0 ... [dom 30 de mayo 19:13:53 2021] Seguimiento de llamadas: [dom 30 de mayo 19:13:53 2021 ] ------------[ cortar aqu\u00ed ]------------ [domingo 30 de mayo 19:13:53 2021] pci_free_p2pmem+0x2b/0x70 [domingo 30 de mayo 19 :13:53 2021] pci_p2pmem_free_sgl+0x4f/0x80 [domingo 30 de mayo 19:13:53 2021] nvmet_req_free_sgls+0x1e/0x80 [nvmet] [domingo 30 de mayo 19:13:53 2021] ERROR del kernel en lib/genalloc.c: 518! [dom 30 de mayo 19:13:53 2021] nvmet_rdma_release_rsp+0x4e/0x1f0 [nvmet_rdma] [dom 30 de mayo 19:13:53 2021] nvmet_rdma_send_done+0x1c/0x60 [nvmet_rdma]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/nvme/target/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c6e3f13398123a008cd2ee28f93510b113a32791\",\"lessThan\":\"c440cd080761b18a52cac20f2a42e5da1e3995af\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c6e3f13398123a008cd2ee28f93510b113a32791\",\"lessThan\":\"8a452d62e7cea3c8a2676a3b89a9118755a1a271\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c6e3f13398123a008cd2ee28f93510b113a32791\",\"lessThan\":\"bcd9a0797d73eeff659582f23277e7ab6e5f18f3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/nvme/target/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.43\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.12.10\",\"lessThanOrEqual\":\"5.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-03-18T15:12:36.061889Z\",\"id\":\"CVE-2021-47130\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.8\",\"versionEndExcluding\":\"5.10.43\",\"matchCriteriaId\":\"68F5A00C-A198-450B-BB15-3EA45C17519F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.12.10\",\"matchCriteriaId\":\"27384800-AB48-4C08-891E-34B66F5FC4AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"96AC23B2-D46A-49D9-8203-8E1BEDCA8532\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA610E30-717C-4700-9F77-A3C9244F3BFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1ECD33F5-85BE-430B-8F86-8D7BD560311D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/8a452d62e7cea3c8a2676a3b89a9118755a1a271\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bcd9a0797d73eeff659582f23277e7ab6e5f18f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c440cd080761b18a52cac20f2a42e5da1e3995af\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8a452d62e7cea3c8a2676a3b89a9118755a1a271\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bcd9a0797d73eeff659582f23277e7ab6e5f18f3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c440cd080761b18a52cac20f2a42e5da1e3995af\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T14:46:15+00:00",
      "cve": "CVE-2021-47130",
      "id": "CVE-2021-47130",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nvmet: fix freeing unallocated p2pmem",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47130.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T02:08:11Z",
      "cve": "CVE-2021-47130",
      "id": "CVE-2021-47130",
      "initial_release_date": "2024-03-19T03:50:23Z",
      "product_status:known_affected": "388",
      "product_status:known_not_affected": "256",
      "product_status:recommended": "91",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47130",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47130.json",
      "version": "39"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c440cd080761b18a52cac20f2a42e5da1e3995af\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8a452d62e7cea3c8a2676a3b89a9118755a1a271\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bcd9a0797d73eeff659582f23277e7ab6e5f18f3\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:24:39.944Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.4, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47130\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-03-18T15:12:36.061889Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:18.322Z\"}}], \"cna\": {\"title\": \"nvmet: fix freeing unallocated p2pmem\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The buggy SGL alloc/free path is reached only from nvmet-rdma (`nvmet_rdma_map_sgl_keyed` \\u2192 `nvmet_req_alloc_sgls` / `nvmet_rdma_release_rsp` \\u2192 `nvmet_req_free_sgls`), which processes NVMe-oF commands from a remote RDMA/RoCE peer over the network.\\nAC:L - In a p2pmem-enabled target deployment, an attacker who can issue I/O controls transfer size and concurrency and can force `pci_p2pmem_alloc_sgl()` to fail so the regular SGL fallback runs with `req-\u003ep2p_dev` still set; the subsequent free reliably hits `BUG()` in `gen_pool_free_owner()`.\\nPR:N - At this vintage there was no DH-CHAP in-band auth, and with `allow_any_host` (a common nvmet config) any network peer can CONNECT and issue I/O; host NQN allowlisting alone is not a credential check, so this matches unauthenticated nvmet DoS scoring (e.g. CVE-2026-22998).\\nUI:N - No victim user action is required once the NVMe target is configured and listening; the attacker only needs to connect and send I/O that exercises the p2pmem fallback path.\\nS:U - Impact is a kernel BUG/oops in the same host kernel authority as the nvmet target; this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\\nC:N - The defect frees a regular SGL through the p2pmem free path and terminates in `BUG()` when the address is not in the p2p gen_pool; it does not disclose kernel memory.\\nI:N - This is a wrong-allocator free that hits an intentional `BUG()` rather than a use-after-free, OOB write, or other memory-corruption primitive usable for integrity compromise or code execution.\\nA:H - Successful trigger causes `kernel BUG at lib/genalloc.c` (`gen_pool_free_owner`), producing a kernel oops/panic and denial of service of the target host.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c6e3f13398123a008cd2ee28f93510b113a32791\", \"lessThan\": \"c440cd080761b18a52cac20f2a42e5da1e3995af\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c6e3f13398123a008cd2ee28f93510b113a32791\", \"lessThan\": \"8a452d62e7cea3c8a2676a3b89a9118755a1a271\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c6e3f13398123a008cd2ee28f93510b113a32791\", \"lessThan\": \"bcd9a0797d73eeff659582f23277e7ab6e5f18f3\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/nvme/target/core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.43\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/nvme/target/core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c440cd080761b18a52cac20f2a42e5da1e3995af\"}, {\"url\": \"https://git.kernel.org/stable/c/8a452d62e7cea3c8a2676a3b89a9118755a1a271\"}, {\"url\": \"https://git.kernel.org/stable/c/bcd9a0797d73eeff659582f23277e7ab6e5f18f3\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvmet: fix freeing unallocated p2pmem\\n\\nIn case p2p device was found but the p2p pool is empty, the nvme target\\nis still trying to free the sgl from the p2p pool instead of the\\nregular sgl pool and causing a crash (BUG() is called). Instead, assign\\nthe p2p_dev for the request only if it was allocated from p2p pool.\\n\\nThis is the crash that was caused:\\n\\n[Sun May 30 19:13:53 2021] ------------[ cut here ]------------\\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\\n[Sun May 30 19:13:53 2021] invalid opcode: 0000 [#1] SMP PTI\\n...\\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\\n...\\n[Sun May 30 19:13:53 2021] RIP: 0010:gen_pool_free_owner+0xa8/0xb0\\n...\\n[Sun May 30 19:13:53 2021] Call Trace:\\n[Sun May 30 19:13:53 2021] ------------[ cut here ]------------\\n[Sun May 30 19:13:53 2021]  pci_free_p2pmem+0x2b/0x70\\n[Sun May 30 19:13:53 2021]  pci_p2pmem_free_sgl+0x4f/0x80\\n[Sun May 30 19:13:53 2021]  nvmet_req_free_sgls+0x1e/0x80 [nvmet]\\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\\n[Sun May 30 19:13:53 2021]  nvmet_rdma_release_rsp+0x4e/0x1f0 [nvmet_rdma]\\n[Sun May 30 19:13:53 2021]  nvmet_rdma_send_done+0x1c/0x60 [nvmet_rdma]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.43\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.10\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13\", \"versionStartIncluding\": \"5.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:46:12.154Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47130\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:46:12.154Z\", \"dateReserved\": \"2024-03-04T18:12:48.840Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-03-15T20:14:33.955Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…

Loading…