CVE-2021-47494 (GCVE-0-2021-47494)

Vulnerability from cvelistv5 – Published: 2024-05-22 08:19 – Updated: 2026-08-05 08:48
VLAI
Title
cfg80211: fix management registrations locking
Summary
In the Linux kernel, the following vulnerability has been resolved: cfg80211: fix management registrations locking The management registrations locking was broken, the list was locked for each wdev, but cfg80211_mgmt_registrations_update() iterated it without holding all the correct spinlocks, causing list corruption. Rather than trying to fix it with fine-grained locking, just move the lock to the wiphy/rdev (still need the list on each wdev), we already need to hold the wdev lock to change it, so there's no contention on the lock in any case. This trivially fixes the bug since we hold one wdev's lock already, and now will hold the lock that protects all lists.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-22 18:38 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 6cd536fe62ef58d7c4eac2da07ab0ed7fd19010d , < 4c22227e39c7a0b4dab55617ee8d34d171fab8d4 (git)
Affected: 6cd536fe62ef58d7c4eac2da07ab0ed7fd19010d , < 3c897f39b71fe68f90599f6a45b5f7bf5618420e (git)
Affected: 6cd536fe62ef58d7c4eac2da07ab0ed7fd19010d , < 09b1d5dc6ce1c9151777f6c4e128a59457704c97 (git)
Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 5.10.77 , ≤ 5.10.* (semver)
Unaffected: 5.14.16 , ≤ 5.14.* (semver)
Unaffected: 5.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47494",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-22T18:38:36.269063Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:15:18.041Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.605Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4c22227e39c7a0b4dab55617ee8d34d171fab8d4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3c897f39b71fe68f90599f6a45b5f7bf5618420e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/09b1d5dc6ce1c9151777f6c4e128a59457704c97"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/cfg80211.h",
            "net/wireless/core.c",
            "net/wireless/core.h",
            "net/wireless/mlme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4c22227e39c7a0b4dab55617ee8d34d171fab8d4",
              "status": "affected",
              "version": "6cd536fe62ef58d7c4eac2da07ab0ed7fd19010d",
              "versionType": "git"
            },
            {
              "lessThan": "3c897f39b71fe68f90599f6a45b5f7bf5618420e",
              "status": "affected",
              "version": "6cd536fe62ef58d7c4eac2da07ab0ed7fd19010d",
              "versionType": "git"
            },
            {
              "lessThan": "09b1d5dc6ce1c9151777f6c4e128a59457704c97",
              "status": "affected",
              "version": "6cd536fe62ef58d7c4eac2da07ab0ed7fd19010d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/cfg80211.h",
            "net/wireless/core.c",
            "net/wireless/core.h",
            "net/wireless/mlme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.14.*",
              "status": "unaffected",
              "version": "5.14.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.77",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.16",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncfg80211: fix management registrations locking\n\nThe management registrations locking was broken, the list was\nlocked for each wdev, but cfg80211_mgmt_registrations_update()\niterated it without holding all the correct spinlocks, causing\nlist corruption.\n\nRather than trying to fix it with fine-grained locking, just\nmove the lock to the wiphy/rdev (still need the list on each\nwdev), we already need to hold the wdev lock to change it, so\nthere\u0027s no contention on the lock in any case. This trivially\nfixes the bug since we hold one wdev\u0027s lock already, and now\nwill hold the lock that protects all lists."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered through local nl80211 Generic Netlink (NL80211_CMD_REGISTER_FRAME and socket close \u2192 cfg80211_mlme_unregister_socket), not by processing WiFi frames alone. Adjacent RX only walks lists under the correct per-wdev lock and does not create the cross-wdev writer race.\nAC:L - The attacker controls both sides of the race by registering management frames on multiple wdevs on the same wiphy and concurrently closing another nl80211 socket so unregister_socket mutates a list while update walks it unlocked. Virtual interfaces are creatable via NL80211_CMD_NEW_INTERFACE, so no external condition is required.\nPR:L - NL80211_CMD_REGISTER_FRAME uses GENL_UNS_ADMIN_PERM, which only requires CAP_NET_ADMIN in the socket netns user namespace, not init-namespace root. Per kernel CNA guidance, CAP_NET_ADMIN reachable via user namespaces scores as Low.\nUI:N - Exploitation needs no victim interaction; the attacker issues netlink registrations and closes sockets directly.\nS:U - Impact stays within the host kernel authority (local memory corruption / privilege escalation class). No VM, IOMMU, or sandbox boundary is crossed.\nC:H - cfg80211_mgmt_registrations_update() can read cfg80211_mgmt_registration objects on another wdev while unregister_socket concurrently list_del/kfree them, yielding a use-after-free. Per guidance, UAFs enable arbitrary kernel memory disclosure.\nI:H - Cross-wdev list corruption and UAF of attacker-influenced kmalloc registration objects can be turned into heap reuse and write primitives for control-flow hijacking. Per guidance, UAF/list corruption scores as High integrity impact.\nA:H - The same unlocked list walk versus concurrent mutation causes kernel oops/panic or hangs from corrupted list pointers, so availability impact is High even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:48:04.885Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4c22227e39c7a0b4dab55617ee8d34d171fab8d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c897f39b71fe68f90599f6a45b5f7bf5618420e"
        },
        {
          "url": "https://git.kernel.org/stable/c/09b1d5dc6ce1c9151777f6c4e128a59457704c97"
        }
      ],
      "title": "cfg80211: fix management registrations locking",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47494",
    "datePublished": "2024-05-22T08:19:42.083Z",
    "dateReserved": "2024-05-22T06:20:56.201Z",
    "dateUpdated": "2026-08-05T08:48:04.885Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47494",
      "date": "2026-08-14",
      "epss": "0.00168",
      "percentile": "0.06539"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncfg80211: fix management registrations locking\\n\\nThe management registrations locking was broken, the list was\\nlocked for each wdev, but cfg80211_mgmt_registrations_update()\\niterated it without holding all the correct spinlocks, causing\\nlist corruption.\\n\\nRather than trying to fix it with fine-grained locking, just\\nmove the lock to the wiphy/rdev (still need the list on each\\nwdev), we already need to hold the wdev lock to change it, so\\nthere\u0027s no contention on the lock in any case. This trivially\\nfixes the bug since we hold one wdev\u0027s lock already, and now\\nwill hold the lock that protects all lists.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: cfg80211: corrige el bloqueo de registros de administraci\\u00f3n. El bloqueo de registros de administraci\\u00f3n estaba roto, la lista estaba bloqueada para cada wdev, pero cfg80211_mgmt_registrations_update() la repiti\\u00f3 sin mantener todos los spinlocks correctos, lo que provoc\\u00f3 corrupci\\u00f3n en la lista. En lugar de intentar solucionarlo con un bloqueo detallado, simplemente mueva el bloqueo a wiphy/rdev (a\\u00fan necesitamos la lista en cada wdev), ya necesitamos mantener presionado el bloqueo wdev para cambiarlo, por lo que no hay contenci\\u00f3n en el bloqueo. En todo caso. Esto soluciona trivialmente el error ya que ya tenemos un bloqueo de wdev y ahora mantendremos el bloqueo que protege todas las listas.\"}]",
      "id": "CVE-2021-47494",
      "lastModified": "2024-11-21T06:36:19.770",
      "published": "2024-05-22T09:15:11.270",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/09b1d5dc6ce1c9151777f6c4e128a59457704c97\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/3c897f39b71fe68f90599f6a45b5f7bf5618420e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/4c22227e39c7a0b4dab55617ee8d34d171fab8d4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/09b1d5dc6ce1c9151777f6c4e128a59457704c97\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/3c897f39b71fe68f90599f6a45b5f7bf5618420e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/4c22227e39c7a0b4dab55617ee8d34d171fab8d4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47494\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-22T09:15:11.270\",\"lastModified\":\"2026-08-04T10:17:05.763\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncfg80211: fix management registrations locking\\n\\nThe management registrations locking was broken, the list was\\nlocked for each wdev, but cfg80211_mgmt_registrations_update()\\niterated it without holding all the correct spinlocks, causing\\nlist corruption.\\n\\nRather than trying to fix it with fine-grained locking, just\\nmove the lock to the wiphy/rdev (still need the list on each\\nwdev), we already need to hold the wdev lock to change it, so\\nthere\u0027s no contention on the lock in any case. This trivially\\nfixes the bug since we hold one wdev\u0027s lock already, and now\\nwill hold the lock that protects all lists.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: cfg80211: corrige el bloqueo de registros de administraci\u00f3n. El bloqueo de registros de administraci\u00f3n estaba roto, la lista estaba bloqueada para cada wdev, pero cfg80211_mgmt_registrations_update() la repiti\u00f3 sin mantener todos los spinlocks correctos, lo que provoc\u00f3 corrupci\u00f3n en la lista. En lugar de intentar solucionarlo con un bloqueo detallado, simplemente mueva el bloqueo a wiphy/rdev (a\u00fan necesitamos la lista en cada wdev), ya necesitamos mantener presionado el bloqueo wdev para cambiarlo, por lo que no hay contenci\u00f3n en el bloqueo. En todo caso. Esto soluciona trivialmente el error ya que ya tenemos un bloqueo de wdev y ahora mantendremos el bloqueo que protege todas las listas.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/cfg80211.h\",\"net/wireless/core.c\",\"net/wireless/core.h\",\"net/wireless/mlme.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6cd536fe62ef58d7c4eac2da07ab0ed7fd19010d\",\"lessThan\":\"4c22227e39c7a0b4dab55617ee8d34d171fab8d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6cd536fe62ef58d7c4eac2da07ab0ed7fd19010d\",\"lessThan\":\"3c897f39b71fe68f90599f6a45b5f7bf5618420e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6cd536fe62ef58d7c4eac2da07ab0ed7fd19010d\",\"lessThan\":\"09b1d5dc6ce1c9151777f6c4e128a59457704c97\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/net/cfg80211.h\",\"net/wireless/core.c\",\"net/wireless/core.h\",\"net/wireless/mlme.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.77\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.14.16\",\"lessThanOrEqual\":\"5.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-22T18:38:36.269063Z\",\"id\":\"CVE-2021-47494\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.8\",\"versionEndExcluding\":\"5.10.77\",\"matchCriteriaId\":\"745FEBF3-CEF9-4E69-833D-F3B05D78C62D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.14.16\",\"matchCriteriaId\":\"2681B950-4548-4649-A9E1-4124B59FC09C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E46C74C6-B76B-4C94-A6A4-FD2FFF62D644\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"60134C3A-06E4-48C1-B04F-2903732A4E56\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"0460DA88-8FE1-46A2-9DDA-1F1ABA552E71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF55383D-4DF2-45DC-93F7-571F4F978EAB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E9481B2-8AA6-4CBD-B5D3-C10F51FF6D01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"EBD45831-4B79-42BC-ABC0-86870F0DEA89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"948A6B8D-1B72-4945-8680-354E53BE1C80\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/09b1d5dc6ce1c9151777f6c4e128a59457704c97\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3c897f39b71fe68f90599f6a45b5f7bf5618420e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c22227e39c7a0b4dab55617ee8d34d171fab8d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/09b1d5dc6ce1c9151777f6c4e128a59457704c97\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3c897f39b71fe68f90599f6a45b5f7bf5618420e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c22227e39c7a0b4dab55617ee8d34d171fab8d4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:57:07+00:00",
      "cve": "CVE-2021-47494",
      "id": "CVE-2021-47494",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "108",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cfg80211: fix management registrations locking",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47494.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T02:05:54Z",
      "cve": "CVE-2021-47494",
      "id": "CVE-2021-47494",
      "initial_release_date": "2024-05-28T15:29:58Z",
      "product_status:known_affected": "269",
      "product_status:known_not_affected": "181",
      "product_status:recommended": "543",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47494",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47494.json",
      "version": "54"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4c22227e39c7a0b4dab55617ee8d34d171fab8d4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3c897f39b71fe68f90599f6a45b5f7bf5618420e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/09b1d5dc6ce1c9151777f6c4e128a59457704c97\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:39:59.605Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47494\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-22T18:38:36.269063Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-22T18:38:42.817Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"cfg80211: fix management registrations locking\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is triggered through local nl80211 Generic Netlink (NL80211_CMD_REGISTER_FRAME and socket close \\u2192 cfg80211_mlme_unregister_socket), not by processing WiFi frames alone. Adjacent RX only walks lists under the correct per-wdev lock and does not create the cross-wdev writer race.\\nAC:L - The attacker controls both sides of the race by registering management frames on multiple wdevs on the same wiphy and concurrently closing another nl80211 socket so unregister_socket mutates a list while update walks it unlocked. Virtual interfaces are creatable via NL80211_CMD_NEW_INTERFACE, so no external condition is required.\\nPR:L - NL80211_CMD_REGISTER_FRAME uses GENL_UNS_ADMIN_PERM, which only requires CAP_NET_ADMIN in the socket netns user namespace, not init-namespace root. Per kernel CNA guidance, CAP_NET_ADMIN reachable via user namespaces scores as Low.\\nUI:N - Exploitation needs no victim interaction; the attacker issues netlink registrations and closes sockets directly.\\nS:U - Impact stays within the host kernel authority (local memory corruption / privilege escalation class). No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - cfg80211_mgmt_registrations_update() can read cfg80211_mgmt_registration objects on another wdev while unregister_socket concurrently list_del/kfree them, yielding a use-after-free. Per guidance, UAFs enable arbitrary kernel memory disclosure.\\nI:H - Cross-wdev list corruption and UAF of attacker-influenced kmalloc registration objects can be turned into heap reuse and write primitives for control-flow hijacking. Per guidance, UAF/list corruption scores as High integrity impact.\\nA:H - The same unlocked list walk versus concurrent mutation causes kernel oops/panic or hangs from corrupted list pointers, so availability impact is High even without full exploitation.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6cd536fe62ef58d7c4eac2da07ab0ed7fd19010d\", \"lessThan\": \"4c22227e39c7a0b4dab55617ee8d34d171fab8d4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6cd536fe62ef58d7c4eac2da07ab0ed7fd19010d\", \"lessThan\": \"3c897f39b71fe68f90599f6a45b5f7bf5618420e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6cd536fe62ef58d7c4eac2da07ab0ed7fd19010d\", \"lessThan\": \"09b1d5dc6ce1c9151777f6c4e128a59457704c97\", \"versionType\": \"git\"}], \"programFiles\": [\"include/net/cfg80211.h\", \"net/wireless/core.c\", \"net/wireless/core.h\", \"net/wireless/mlme.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.77\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.14.16\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.14.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/net/cfg80211.h\", \"net/wireless/core.c\", \"net/wireless/core.h\", \"net/wireless/mlme.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4c22227e39c7a0b4dab55617ee8d34d171fab8d4\"}, {\"url\": \"https://git.kernel.org/stable/c/3c897f39b71fe68f90599f6a45b5f7bf5618420e\"}, {\"url\": \"https://git.kernel.org/stable/c/09b1d5dc6ce1c9151777f6c4e128a59457704c97\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncfg80211: fix management registrations locking\\n\\nThe management registrations locking was broken, the list was\\nlocked for each wdev, but cfg80211_mgmt_registrations_update()\\niterated it without holding all the correct spinlocks, causing\\nlist corruption.\\n\\nRather than trying to fix it with fine-grained locking, just\\nmove the lock to the wiphy/rdev (still need the list on each\\nwdev), we already need to hold the wdev lock to change it, so\\nthere\u0027s no contention on the lock in any case. This trivially\\nfixes the bug since we hold one wdev\u0027s lock already, and now\\nwill hold the lock that protects all lists.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.77\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.14.16\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15\", \"versionStartIncluding\": \"5.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:48:04.885Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47494\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:48:04.885Z\", \"dateReserved\": \"2024-05-22T06:20:56.201Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-22T08:19:42.083Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.