CVE-2021-47552 (GCVE-0-2021-47552)
Vulnerability from cvelistv5 – Published: 2024-05-24 15:09 – Updated: 2026-08-05 08:48
VLAI
EPSS
VEX
Title
blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()
Summary
In the Linux kernel, the following vulnerability has been resolved:
blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()
For avoiding to slow down queue destroy, we don't call
blk_mq_quiesce_queue() in blk_cleanup_queue(), instead of delaying to
cancel dispatch work in blk_release_queue().
However, this way has caused kernel oops[1], reported by Changhui. The log
shows that scsi_device can be freed before running blk_release_queue(),
which is expected too since scsi_device is released after the scsi disk
is closed and the scsi_device is removed.
Fixes the issue by canceling blk-mq dispatch work in both blk_cleanup_queue()
and disk_release():
1) when disk_release() is run, the disk has been closed, and any sync
dispatch activities have been done, so canceling dispatch work is enough to
quiesce filesystem I/O dispatch activity.
2) in blk_cleanup_queue(), we only focus on passthrough request, and
passthrough request is always explicitly allocated & freed by
its caller, so once queue is frozen, all sync dispatch activity
for passthrough request has been done, then it is enough to just cancel
dispatch work for avoiding any dispatch activity.
[1] kernel panic log
[12622.769416] BUG: kernel NULL pointer dereference, address: 0000000000000300
[12622.777186] #PF: supervisor read access in kernel mode
[12622.782918] #PF: error_code(0x0000) - not-present page
[12622.788649] PGD 0 P4D 0
[12622.791474] Oops: 0000 [#1] PREEMPT SMP PTI
[12622.796138] CPU: 10 PID: 744 Comm: kworker/10:1H Kdump: loaded Not tainted 5.15.0+ #1
[12622.804877] Hardware name: Dell Inc. PowerEdge R730/0H21J3, BIOS 1.5.4 10/002/2015
[12622.813321] Workqueue: kblockd blk_mq_run_work_fn
[12622.818572] RIP: 0010:sbitmap_get+0x75/0x190
[12622.823336] Code: 85 80 00 00 00 41 8b 57 08 85 d2 0f 84 b1 00 00 00 45 31 e4 48 63 cd 48 8d 1c 49 48 c1 e3 06 49 03 5f 10 4c 8d 6b 40 83 f0 01 <48> 8b 33 44 89 f2 4c 89 ef 0f b6 c8 e8 fa f3 ff ff 83 f8 ff 75 58
[12622.844290] RSP: 0018:ffffb00a446dbd40 EFLAGS: 00010202
[12622.850120] RAX: 0000000000000001 RBX: 0000000000000300 RCX: 0000000000000004
[12622.858082] RDX: 0000000000000006 RSI: 0000000000000082 RDI: ffffa0b7a2dfe030
[12622.866042] RBP: 0000000000000004 R08: 0000000000000001 R09: ffffa0b742721334
[12622.874003] R10: 0000000000000008 R11: 0000000000000008 R12: 0000000000000000
[12622.881964] R13: 0000000000000340 R14: 0000000000000000 R15: ffffa0b7a2dfe030
[12622.889926] FS: 0000000000000000(0000) GS:ffffa0baafb40000(0000) knlGS:0000000000000000
[12622.898956] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[12622.905367] CR2: 0000000000000300 CR3: 0000000641210001 CR4: 00000000001706e0
[12622.913328] Call Trace:
[12622.916055] <TASK>
[12622.918394] scsi_mq_get_budget+0x1a/0x110
[12622.922969] __blk_mq_do_dispatch_sched+0x1d4/0x320
[12622.928404] ? pick_next_task_fair+0x39/0x390
[12622.933268] __blk_mq_sched_dispatch_requests+0xf4/0x140
[12622.939194] blk_mq_sched_dispatch_requests+0x30/0x60
[12622.944829] __blk_mq_run_hw_queue+0x30/0xa0
[12622.949593] process_one_work+0x1e8/0x3c0
[12622.954059] worker_thread+0x50/0x3b0
[12622.958144] ? rescuer_thread+0x370/0x370
[12622.962616] kthread+0x158/0x180
[12622.966218] ? set_kthread_struct+0x40/0x40
[12622.970884] ret_from_fork+0x22/0x30
[12622.974875] </TASK>
[12622.977309] Modules linked in: scsi_debug rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs sunrpc dm_multipath intel_rapl_msr intel_rapl_common dell_wmi_descriptor sb_edac rfkill video x86_pkg_temp_thermal intel_powerclamp dcdbas coretemp kvm_intel kvm mgag200 irqbypass i2c_algo_bit rapl drm_kms_helper ipmi_ssif intel_cstate intel_uncore syscopyarea sysfillrect sysimgblt fb_sys_fops pcspkr cec mei_me lpc_ich mei ipmi_si ipmi_devintf ipmi_msghandler acpi_power_meter drm fuse xfs libcrc32c sr_mod cdrom sd_mod t10_pi sg ixgbe ahci libahci crct10dif_pclmul crc32_pclmul crc32c_intel libata megaraid_sas ghash_clmulni_intel tg3 wdat_w
---truncated---
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-10 18:51 UTC
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
1b97871b501f1bac0fd39a073c4c8473ee457a55 , < e03513f58919d9e2bc6df765ca2c9da863d03d90
(git)
Affected: 1b97871b501f1bac0fd39a073c4c8473ee457a55 , < 2a19b28f7929866e1cec92a3619f4de9f2d20005 (git) |
guessed | |
| Linux | Linux |
Affected:
5.2
Unaffected: 0 , < 5.2 (semver) Unaffected: 5.15.6 , ≤ 5.15.* (semver) Unaffected: 5.16 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-47552",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-10T18:51:40.130772Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-10T18:51:50.154Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:39:59.804Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/e03513f58919d9e2bc6df765ca2c9da863d03d90"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/2a19b28f7929866e1cec92a3619f4de9f2d20005"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/blk-core.c",
"block/blk-mq.c",
"block/blk-mq.h",
"block/blk-sysfs.c",
"block/genhd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e03513f58919d9e2bc6df765ca2c9da863d03d90",
"status": "affected",
"version": "1b97871b501f1bac0fd39a073c4c8473ee457a55",
"versionType": "git"
},
{
"lessThan": "2a19b28f7929866e1cec92a3619f4de9f2d20005",
"status": "affected",
"version": "1b97871b501f1bac0fd39a073c4c8473ee457a55",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/blk-core.c",
"block/blk-mq.c",
"block/blk-mq.h",
"block/blk-sysfs.c",
"block/genhd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.6",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.16",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()\n\nFor avoiding to slow down queue destroy, we don\u0027t call\nblk_mq_quiesce_queue() in blk_cleanup_queue(), instead of delaying to\ncancel dispatch work in blk_release_queue().\n\nHowever, this way has caused kernel oops[1], reported by Changhui. The log\nshows that scsi_device can be freed before running blk_release_queue(),\nwhich is expected too since scsi_device is released after the scsi disk\nis closed and the scsi_device is removed.\n\nFixes the issue by canceling blk-mq dispatch work in both blk_cleanup_queue()\nand disk_release():\n\n1) when disk_release() is run, the disk has been closed, and any sync\ndispatch activities have been done, so canceling dispatch work is enough to\nquiesce filesystem I/O dispatch activity.\n\n2) in blk_cleanup_queue(), we only focus on passthrough request, and\npassthrough request is always explicitly allocated \u0026 freed by\nits caller, so once queue is frozen, all sync dispatch activity\nfor passthrough request has been done, then it is enough to just cancel\ndispatch work for avoiding any dispatch activity.\n\n[1] kernel panic log\n[12622.769416] BUG: kernel NULL pointer dereference, address: 0000000000000300\n[12622.777186] #PF: supervisor read access in kernel mode\n[12622.782918] #PF: error_code(0x0000) - not-present page\n[12622.788649] PGD 0 P4D 0\n[12622.791474] Oops: 0000 [#1] PREEMPT SMP PTI\n[12622.796138] CPU: 10 PID: 744 Comm: kworker/10:1H Kdump: loaded Not tainted 5.15.0+ #1\n[12622.804877] Hardware name: Dell Inc. PowerEdge R730/0H21J3, BIOS 1.5.4 10/002/2015\n[12622.813321] Workqueue: kblockd blk_mq_run_work_fn\n[12622.818572] RIP: 0010:sbitmap_get+0x75/0x190\n[12622.823336] Code: 85 80 00 00 00 41 8b 57 08 85 d2 0f 84 b1 00 00 00 45 31 e4 48 63 cd 48 8d 1c 49 48 c1 e3 06 49 03 5f 10 4c 8d 6b 40 83 f0 01 \u003c48\u003e 8b 33 44 89 f2 4c 89 ef 0f b6 c8 e8 fa f3 ff ff 83 f8 ff 75 58\n[12622.844290] RSP: 0018:ffffb00a446dbd40 EFLAGS: 00010202\n[12622.850120] RAX: 0000000000000001 RBX: 0000000000000300 RCX: 0000000000000004\n[12622.858082] RDX: 0000000000000006 RSI: 0000000000000082 RDI: ffffa0b7a2dfe030\n[12622.866042] RBP: 0000000000000004 R08: 0000000000000001 R09: ffffa0b742721334\n[12622.874003] R10: 0000000000000008 R11: 0000000000000008 R12: 0000000000000000\n[12622.881964] R13: 0000000000000340 R14: 0000000000000000 R15: ffffa0b7a2dfe030\n[12622.889926] FS: 0000000000000000(0000) GS:ffffa0baafb40000(0000) knlGS:0000000000000000\n[12622.898956] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[12622.905367] CR2: 0000000000000300 CR3: 0000000641210001 CR4: 00000000001706e0\n[12622.913328] Call Trace:\n[12622.916055] \u003cTASK\u003e\n[12622.918394] scsi_mq_get_budget+0x1a/0x110\n[12622.922969] __blk_mq_do_dispatch_sched+0x1d4/0x320\n[12622.928404] ? pick_next_task_fair+0x39/0x390\n[12622.933268] __blk_mq_sched_dispatch_requests+0xf4/0x140\n[12622.939194] blk_mq_sched_dispatch_requests+0x30/0x60\n[12622.944829] __blk_mq_run_hw_queue+0x30/0xa0\n[12622.949593] process_one_work+0x1e8/0x3c0\n[12622.954059] worker_thread+0x50/0x3b0\n[12622.958144] ? rescuer_thread+0x370/0x370\n[12622.962616] kthread+0x158/0x180\n[12622.966218] ? set_kthread_struct+0x40/0x40\n[12622.970884] ret_from_fork+0x22/0x30\n[12622.974875] \u003c/TASK\u003e\n[12622.977309] Modules linked in: scsi_debug rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs sunrpc dm_multipath intel_rapl_msr intel_rapl_common dell_wmi_descriptor sb_edac rfkill video x86_pkg_temp_thermal intel_powerclamp dcdbas coretemp kvm_intel kvm mgag200 irqbypass i2c_algo_bit rapl drm_kms_helper ipmi_ssif intel_cstate intel_uncore syscopyarea sysfillrect sysimgblt fb_sys_fops pcspkr cec mei_me lpc_ich mei ipmi_si ipmi_devintf ipmi_msghandler acpi_power_meter drm fuse xfs libcrc32c sr_mod cdrom sd_mod t10_pi sg ixgbe ahci libahci crct10dif_pclmul crc32_pclmul crc32c_intel libata megaraid_sas ghash_clmulni_intel tg3 wdat_w\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached through local block-layer teardown (SCSI device removal / disk_release / blk_cleanup_queue), for example via sysfs delete, module unload, or removable USB storage power-off\u2014not via network packet processing.\nAC:L - An attacker who can issue I/O (scheduling hctx-\u003erun_work) and then remove the device controls both sides of the lifetime gap; the pending dispatch work reliably runs after scsi_device is freed because cancel was deferred to blk_release_queue.\nPR:L - A normal local user can trigger removal of removable SCSI/USB block devices they are allowed to use (e.g. desktop seat polkit/udisks \u201cpower off\u201d), without needing real init-namespace root or userns-unreachable capabilities.\nUI:N - The attacker performs I/O and device removal themselves; no separate victim action is required.\nS:U - Impact stays within the local kernel/host authority (UAF in blk-mq/SCSI), with no VM/IOMMU/sandbox boundary crossing.\nC:H - q-\u003equeuedata remains a dangling pointer to the freed scsi_device while dispatch work can still call scsi_mq_get_budget/sbitmap_get; that UAF can be sprayed to obtain arbitrary kernel read primitives.\nI:H - The same post-free scsi_device/sbitmap object is attacker-controllable via heap spray, enabling corrupted map pointers and write/control-flow primitives through the dispatch get_budget path.\nA:H - The reported failure is a kernel NULL deref/oops in sbitmap_get from kblockd (and any UAF here can equally crash the kernel), so availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T08:48:22.040Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e03513f58919d9e2bc6df765ca2c9da863d03d90"
},
{
"url": "https://git.kernel.org/stable/c/2a19b28f7929866e1cec92a3619f4de9f2d20005"
}
],
"title": "blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2021-47552",
"datePublished": "2024-05-24T15:09:55.295Z",
"dateReserved": "2024-05-24T15:02:54.832Z",
"dateUpdated": "2026-08-05T08:48:22.040Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2021-47552",
"date": "2026-09-13",
"epss": "0.0021",
"percentile": "0.11221"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.15.6\", \"matchCriteriaId\": \"8A9D3A0C-7C16-4DE1-9115-F24F38C1D07F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"357AA433-37E8-4323-BFB2-3038D6E4B414\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()\\n\\nFor avoiding to slow down queue destroy, we don\u0027t call\\nblk_mq_quiesce_queue() in blk_cleanup_queue(), instead of delaying to\\ncancel dispatch work in blk_release_queue().\\n\\nHowever, this way has caused kernel oops[1], reported by Changhui. The log\\nshows that scsi_device can be freed before running blk_release_queue(),\\nwhich is expected too since scsi_device is released after the scsi disk\\nis closed and the scsi_device is removed.\\n\\nFixes the issue by canceling blk-mq dispatch work in both blk_cleanup_queue()\\nand disk_release():\\n\\n1) when disk_release() is run, the disk has been closed, and any sync\\ndispatch activities have been done, so canceling dispatch work is enough to\\nquiesce filesystem I/O dispatch activity.\\n\\n2) in blk_cleanup_queue(), we only focus on passthrough request, and\\npassthrough request is always explicitly allocated \u0026 freed by\\nits caller, so once queue is frozen, all sync dispatch activity\\nfor passthrough request has been done, then it is enough to just cancel\\ndispatch work for avoiding any dispatch activity.\\n\\n[1] kernel panic log\\n[12622.769416] BUG: kernel NULL pointer dereference, address: 0000000000000300\\n[12622.777186] #PF: supervisor read access in kernel mode\\n[12622.782918] #PF: error_code(0x0000) - not-present page\\n[12622.788649] PGD 0 P4D 0\\n[12622.791474] Oops: 0000 [#1] PREEMPT SMP PTI\\n[12622.796138] CPU: 10 PID: 744 Comm: kworker/10:1H Kdump: loaded Not tainted 5.15.0+ #1\\n[12622.804877] Hardware name: Dell Inc. PowerEdge R730/0H21J3, BIOS 1.5.4 10/002/2015\\n[12622.813321] Workqueue: kblockd blk_mq_run_work_fn\\n[12622.818572] RIP: 0010:sbitmap_get+0x75/0x190\\n[12622.823336] Code: 85 80 00 00 00 41 8b 57 08 85 d2 0f 84 b1 00 00 00 45 31 e4 48 63 cd 48 8d 1c 49 48 c1 e3 06 49 03 5f 10 4c 8d 6b 40 83 f0 01 \u003c48\u003e 8b 33 44 89 f2 4c 89 ef 0f b6 c8 e8 fa f3 ff ff 83 f8 ff 75 58\\n[12622.844290] RSP: 0018:ffffb00a446dbd40 EFLAGS: 00010202\\n[12622.850120] RAX: 0000000000000001 RBX: 0000000000000300 RCX: 0000000000000004\\n[12622.858082] RDX: 0000000000000006 RSI: 0000000000000082 RDI: ffffa0b7a2dfe030\\n[12622.866042] RBP: 0000000000000004 R08: 0000000000000001 R09: ffffa0b742721334\\n[12622.874003] R10: 0000000000000008 R11: 0000000000000008 R12: 0000000000000000\\n[12622.881964] R13: 0000000000000340 R14: 0000000000000000 R15: ffffa0b7a2dfe030\\n[12622.889926] FS: 0000000000000000(0000) GS:ffffa0baafb40000(0000) knlGS:0000000000000000\\n[12622.898956] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[12622.905367] CR2: 0000000000000300 CR3: 0000000641210001 CR4: 00000000001706e0\\n[12622.913328] Call Trace:\\n[12622.916055] \u003cTASK\u003e\\n[12622.918394] scsi_mq_get_budget+0x1a/0x110\\n[12622.922969] __blk_mq_do_dispatch_sched+0x1d4/0x320\\n[12622.928404] ? pick_next_task_fair+0x39/0x390\\n[12622.933268] __blk_mq_sched_dispatch_requests+0xf4/0x140\\n[12622.939194] blk_mq_sched_dispatch_requests+0x30/0x60\\n[12622.944829] __blk_mq_run_hw_queue+0x30/0xa0\\n[12622.949593] process_one_work+0x1e8/0x3c0\\n[12622.954059] worker_thread+0x50/0x3b0\\n[12622.958144] ? rescuer_thread+0x370/0x370\\n[12622.962616] kthread+0x158/0x180\\n[12622.966218] ? set_kthread_struct+0x40/0x40\\n[12622.970884] ret_from_fork+0x22/0x30\\n[12622.974875] \u003c/TASK\u003e\\n[12622.977309] Modules linked in: scsi_debug rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs sunrpc dm_multipath intel_rapl_msr intel_rapl_common dell_wmi_descriptor sb_edac rfkill video x86_pkg_temp_thermal intel_powerclamp dcdbas coretemp kvm_intel kvm mgag200 irqbypass i2c_algo_bit rapl drm_kms_helper ipmi_ssif intel_cstate intel_uncore syscopyarea sysfillrect sysimgblt fb_sys_fops pcspkr cec mei_me lpc_ich mei ipmi_si ipmi_devintf ipmi_msghandler acpi_power_meter drm fuse xfs libcrc32c sr_mod cdrom sd_mod t10_pi sg ixgbe ahci libahci crct10dif_pclmul crc32_pclmul crc32c_intel libata megaraid_sas ghash_clmulni_intel tg3 wdat_w\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: blk-mq: cancela el trabajo de env\\u00edo de blk-mq tanto en blk_cleanup_queue como en disk_release() Para evitar ralentizar la destrucci\\u00f3n de la cola, no llamamos a blk_mq_quiesce_queue() en blk_cleanup_queue(). en lugar de retrasar la cancelaci\\u00f3n del trabajo de env\\u00edo en blk_release_queue(). Sin embargo, esta forma ha provocado errores en el kernel[1], seg\\u00fan inform\\u00f3 Changhui. El registro muestra que scsi_device se puede liberar antes de ejecutar blk_release_queue(), lo cual tambi\\u00e9n se espera ya que scsi_device se libera despu\\u00e9s de que se cierra el disco scsi y se elimina scsi_device. Soluciona el problema cancelando el trabajo de env\\u00edo de blk-mq tanto en blk_cleanup_queue() como en disk_release(): 1) cuando se ejecuta disk_release(), el disco se ha cerrado y se han realizado todas las actividades de env\\u00edo de sincronizaci\\u00f3n, por lo que cancelar el trabajo de env\\u00edo es suficiente para inmovilizar la actividad de env\\u00edo de E/S del sistema de archivos. 2) en blk_cleanup_queue(), solo nos centramos en la solicitud de paso a trav\\u00e9s, y la persona que llama siempre asigna y libera expl\\u00edcitamente la solicitud de paso a trav\\u00e9s, por lo que una vez que la cola se congela, se ha realizado toda la actividad de env\\u00edo de sincronizaci\\u00f3n para la solicitud de paso a trav\\u00e9s, entonces es suficiente con simplemente cancelar el trabajo de despacho para evitar cualquier actividad de despacho. [1] registro de p\\u00e1nico del kernel [12622.769416] ERROR: desreferencia del puntero NULL del kernel, direcci\\u00f3n: 0000000000000300 [12622.777186] #PF: acceso de lectura del supervisor en modo kernel [12622.782918] #PF: c\\u00f3digo de error (0x0000) - p\\u00e1gina no presente [12622.788649] re 0 P4D 0 [12622.791474] Ups: 0000 [#1] PREEMPT SMP PTI [12622.796138] CPU: 10 PID: 744 Comm: kworker/10:1H Kdump: cargado No contaminado 5.15.0+ #1 [12622.804877] Nombre de hardware: Dell Inc. PowerEdge R730/0H21J3, BIOS 1.5.4 10/002/2015 [12622.813321] Cola de trabajo: kblockd blk_mq_run_work_fn [12622.818572] RIP: 0010:sbitmap_get+0x75/0x190 [12622.823336] C\\u00f3digo: 85 80 00 00 00 41 8b 57 08 85 d2 0f 84 b1 00 00 00 45 31 e4 48 63 cd 48 8d 1c 49 48 c1 e3 06 49 03 5f 10 4c 8d 6b 40 83 f0 01 \u0026lt;48\u0026gt; 8b 33 44 89 f2 4c 89 ef 0f b6 c8 e 8 fa f3 ff ff 83 f8 ff 75 58 [12622.844290] RSP: 0018:ffffb00a446dbd40 EFLAGS: 00010202 [12622.850120] RAX: 00000000000000001 RBX: 0000000000000300 0000000000000004 [12622.858082] RDX: 0000000000000006 RSI: 0000000000000082 RDI: ffffa0b7a2dfe030 [12622.866042] RBP: 0000000000000004 8: 0000000000000001 R09: ffffa0b742721334 [12622.874003] R10: 0000000000000008 R11: 0000000000000008 R12: 00000000000000000 [12622.881964] R13: 0000340 R14: 0000000000000000 R15: ffffa0b7a2dfe030 [12622.889926] FS: 0000000000000000(0000) GS:ffffa0baafb40000(0000) knlGS:000000000000000 00 [12622.898956] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [12622.905367] CR2: 0000000000000300 CR3: 0000000641210001 CR4: 00000000001706e0 [12622.913 328] Seguimiento de llamadas: [12622.916055] [12622.918394] scsi_mq_get_budget+0x1a/0x110 [12622.922969] __blk_mq_do_dispatch_sched+0x1d4/0x320 [12622.928404] ? pick_next_task_fair+0x39/0x390 [12622.933268] __blk_mq_sched_dispatch_requests+0xf4/0x140 [12622.939194] blk_mq_sched_dispatch_requests+0x30/0x60 [12622.944829] q_run_hw_queue+0x30/0xa0 [12622.949593] proceso_one_work+0x1e8/0x3c0 [12622.954059] trabajador_thread+0x50/0x3b0 [12622.958144] ? hilo_rescate+0x370/0x370 [12622.962616] kthread+0x158/0x180 [12622.966218] ? set_kthread_struct+0x40/0x40 [12622.970884] ret_from_fork+0x22/0x30 [12622.974875] [12622.977309] M\\u00f3dulos vinculados en: scsi_debug rpcsec_gss_krb5 auth_rpcgss nfsv4 solucionador nfs lockd gracia fscache netfs sunrpc dm_multipath intel_rapl_msr intel_rapl_common dell_wmi_descriptor sb_edac rfkill video x86_pkg_temp_thermal intel_powerclamp dcdbas coretemp kvm_intel kvm mgag200 irqbypass i2c_algo_bit rapl drm_kms_helper ipmi_ssif intel_cstate intel_uncore syscopyarea ---truncado---\"}]",
"id": "CVE-2021-47552",
"lastModified": "2025-01-06T20:47:35.617",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
"published": "2024-05-24T15:15:20.000",
"references": "[{\"url\": \"https://git.kernel.org/stable/c/2a19b28f7929866e1cec92a3619f4de9f2d20005\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e03513f58919d9e2bc6df765ca2c9da863d03d90\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/2a19b28f7929866e1cec92a3619f4de9f2d20005\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e03513f58919d9e2bc6df765ca2c9da863d03d90\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Analyzed",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2021-47552\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-24T15:15:20.000\",\"lastModified\":\"2026-08-04T10:17:08.473\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()\\n\\nFor avoiding to slow down queue destroy, we don\u0027t call\\nblk_mq_quiesce_queue() in blk_cleanup_queue(), instead of delaying to\\ncancel dispatch work in blk_release_queue().\\n\\nHowever, this way has caused kernel oops[1], reported by Changhui. The log\\nshows that scsi_device can be freed before running blk_release_queue(),\\nwhich is expected too since scsi_device is released after the scsi disk\\nis closed and the scsi_device is removed.\\n\\nFixes the issue by canceling blk-mq dispatch work in both blk_cleanup_queue()\\nand disk_release():\\n\\n1) when disk_release() is run, the disk has been closed, and any sync\\ndispatch activities have been done, so canceling dispatch work is enough to\\nquiesce filesystem I/O dispatch activity.\\n\\n2) in blk_cleanup_queue(), we only focus on passthrough request, and\\npassthrough request is always explicitly allocated \u0026 freed by\\nits caller, so once queue is frozen, all sync dispatch activity\\nfor passthrough request has been done, then it is enough to just cancel\\ndispatch work for avoiding any dispatch activity.\\n\\n[1] kernel panic log\\n[12622.769416] BUG: kernel NULL pointer dereference, address: 0000000000000300\\n[12622.777186] #PF: supervisor read access in kernel mode\\n[12622.782918] #PF: error_code(0x0000) - not-present page\\n[12622.788649] PGD 0 P4D 0\\n[12622.791474] Oops: 0000 [#1] PREEMPT SMP PTI\\n[12622.796138] CPU: 10 PID: 744 Comm: kworker/10:1H Kdump: loaded Not tainted 5.15.0+ #1\\n[12622.804877] Hardware name: Dell Inc. PowerEdge R730/0H21J3, BIOS 1.5.4 10/002/2015\\n[12622.813321] Workqueue: kblockd blk_mq_run_work_fn\\n[12622.818572] RIP: 0010:sbitmap_get+0x75/0x190\\n[12622.823336] Code: 85 80 00 00 00 41 8b 57 08 85 d2 0f 84 b1 00 00 00 45 31 e4 48 63 cd 48 8d 1c 49 48 c1 e3 06 49 03 5f 10 4c 8d 6b 40 83 f0 01 \u003c48\u003e 8b 33 44 89 f2 4c 89 ef 0f b6 c8 e8 fa f3 ff ff 83 f8 ff 75 58\\n[12622.844290] RSP: 0018:ffffb00a446dbd40 EFLAGS: 00010202\\n[12622.850120] RAX: 0000000000000001 RBX: 0000000000000300 RCX: 0000000000000004\\n[12622.858082] RDX: 0000000000000006 RSI: 0000000000000082 RDI: ffffa0b7a2dfe030\\n[12622.866042] RBP: 0000000000000004 R08: 0000000000000001 R09: ffffa0b742721334\\n[12622.874003] R10: 0000000000000008 R11: 0000000000000008 R12: 0000000000000000\\n[12622.881964] R13: 0000000000000340 R14: 0000000000000000 R15: ffffa0b7a2dfe030\\n[12622.889926] FS: 0000000000000000(0000) GS:ffffa0baafb40000(0000) knlGS:0000000000000000\\n[12622.898956] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[12622.905367] CR2: 0000000000000300 CR3: 0000000641210001 CR4: 00000000001706e0\\n[12622.913328] Call Trace:\\n[12622.916055] \u003cTASK\u003e\\n[12622.918394] scsi_mq_get_budget+0x1a/0x110\\n[12622.922969] __blk_mq_do_dispatch_sched+0x1d4/0x320\\n[12622.928404] ? pick_next_task_fair+0x39/0x390\\n[12622.933268] __blk_mq_sched_dispatch_requests+0xf4/0x140\\n[12622.939194] blk_mq_sched_dispatch_requests+0x30/0x60\\n[12622.944829] __blk_mq_run_hw_queue+0x30/0xa0\\n[12622.949593] process_one_work+0x1e8/0x3c0\\n[12622.954059] worker_thread+0x50/0x3b0\\n[12622.958144] ? rescuer_thread+0x370/0x370\\n[12622.962616] kthread+0x158/0x180\\n[12622.966218] ? set_kthread_struct+0x40/0x40\\n[12622.970884] ret_from_fork+0x22/0x30\\n[12622.974875] \u003c/TASK\u003e\\n[12622.977309] Modules linked in: scsi_debug rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs sunrpc dm_multipath intel_rapl_msr intel_rapl_common dell_wmi_descriptor sb_edac rfkill video x86_pkg_temp_thermal intel_powerclamp dcdbas coretemp kvm_intel kvm mgag200 irqbypass i2c_algo_bit rapl drm_kms_helper ipmi_ssif intel_cstate intel_uncore syscopyarea sysfillrect sysimgblt fb_sys_fops pcspkr cec mei_me lpc_ich mei ipmi_si ipmi_devintf ipmi_msghandler acpi_power_meter drm fuse xfs libcrc32c sr_mod cdrom sd_mod t10_pi sg ixgbe ahci libahci crct10dif_pclmul crc32_pclmul crc32c_intel libata megaraid_sas ghash_clmulni_intel tg3 wdat_w\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: blk-mq: cancela el trabajo de env\u00edo de blk-mq tanto en blk_cleanup_queue como en disk_release() Para evitar ralentizar la destrucci\u00f3n de la cola, no llamamos a blk_mq_quiesce_queue() en blk_cleanup_queue(). en lugar de retrasar la cancelaci\u00f3n del trabajo de env\u00edo en blk_release_queue(). Sin embargo, esta forma ha provocado errores en el kernel[1], seg\u00fan inform\u00f3 Changhui. El registro muestra que scsi_device se puede liberar antes de ejecutar blk_release_queue(), lo cual tambi\u00e9n se espera ya que scsi_device se libera despu\u00e9s de que se cierra el disco scsi y se elimina scsi_device. Soluciona el problema cancelando el trabajo de env\u00edo de blk-mq tanto en blk_cleanup_queue() como en disk_release(): 1) cuando se ejecuta disk_release(), el disco se ha cerrado y se han realizado todas las actividades de env\u00edo de sincronizaci\u00f3n, por lo que cancelar el trabajo de env\u00edo es suficiente para inmovilizar la actividad de env\u00edo de E/S del sistema de archivos. 2) en blk_cleanup_queue(), solo nos centramos en la solicitud de paso a trav\u00e9s, y la persona que llama siempre asigna y libera expl\u00edcitamente la solicitud de paso a trav\u00e9s, por lo que una vez que la cola se congela, se ha realizado toda la actividad de env\u00edo de sincronizaci\u00f3n para la solicitud de paso a trav\u00e9s, entonces es suficiente con simplemente cancelar el trabajo de despacho para evitar cualquier actividad de despacho. [1] registro de p\u00e1nico del kernel [12622.769416] ERROR: desreferencia del puntero NULL del kernel, direcci\u00f3n: 0000000000000300 [12622.777186] #PF: acceso de lectura del supervisor en modo kernel [12622.782918] #PF: c\u00f3digo de error (0x0000) - p\u00e1gina no presente [12622.788649] re 0 P4D 0 [12622.791474] Ups: 0000 [#1] PREEMPT SMP PTI [12622.796138] CPU: 10 PID: 744 Comm: kworker/10:1H Kdump: cargado No contaminado 5.15.0+ #1 [12622.804877] Nombre de hardware: Dell Inc. PowerEdge R730/0H21J3, BIOS 1.5.4 10/002/2015 [12622.813321] Cola de trabajo: kblockd blk_mq_run_work_fn [12622.818572] RIP: 0010:sbitmap_get+0x75/0x190 [12622.823336] C\u00f3digo: 85 80 00 00 00 41 8b 57 08 85 d2 0f 84 b1 00 00 00 45 31 e4 48 63 cd 48 8d 1c 49 48 c1 e3 06 49 03 5f 10 4c 8d 6b 40 83 f0 01 \u0026lt;48\u0026gt; 8b 33 44 89 f2 4c 89 ef 0f b6 c8 e 8 fa f3 ff ff 83 f8 ff 75 58 [12622.844290] RSP: 0018:ffffb00a446dbd40 EFLAGS: 00010202 [12622.850120] RAX: 00000000000000001 RBX: 0000000000000300 0000000000000004 [12622.858082] RDX: 0000000000000006 RSI: 0000000000000082 RDI: ffffa0b7a2dfe030 [12622.866042] RBP: 0000000000000004 8: 0000000000000001 R09: ffffa0b742721334 [12622.874003] R10: 0000000000000008 R11: 0000000000000008 R12: 00000000000000000 [12622.881964] R13: 0000340 R14: 0000000000000000 R15: ffffa0b7a2dfe030 [12622.889926] FS: 0000000000000000(0000) GS:ffffa0baafb40000(0000) knlGS:000000000000000 00 [12622.898956] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [12622.905367] CR2: 0000000000000300 CR3: 0000000641210001 CR4: 00000000001706e0 [12622.913 328] Seguimiento de llamadas: [12622.916055] [12622.918394] scsi_mq_get_budget+0x1a/0x110 [12622.922969] __blk_mq_do_dispatch_sched+0x1d4/0x320 [12622.928404] ? pick_next_task_fair+0x39/0x390 [12622.933268] __blk_mq_sched_dispatch_requests+0xf4/0x140 [12622.939194] blk_mq_sched_dispatch_requests+0x30/0x60 [12622.944829] q_run_hw_queue+0x30/0xa0 [12622.949593] proceso_one_work+0x1e8/0x3c0 [12622.954059] trabajador_thread+0x50/0x3b0 [12622.958144] ? hilo_rescate+0x370/0x370 [12622.962616] kthread+0x158/0x180 [12622.966218] ? set_kthread_struct+0x40/0x40 [12622.970884] ret_from_fork+0x22/0x30 [12622.974875] [12622.977309] M\u00f3dulos vinculados en: scsi_debug rpcsec_gss_krb5 auth_rpcgss nfsv4 solucionador nfs lockd gracia fscache netfs sunrpc dm_multipath intel_rapl_msr intel_rapl_common dell_wmi_descriptor sb_edac rfkill video x86_pkg_temp_thermal intel_powerclamp dcdbas coretemp kvm_intel kvm mgag200 irqbypass i2c_algo_bit rapl drm_kms_helper ipmi_ssif intel_cstate intel_uncore syscopyarea ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"block/blk-core.c\",\"block/blk-mq.c\",\"block/blk-mq.h\",\"block/blk-sysfs.c\",\"block/genhd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1b97871b501f1bac0fd39a073c4c8473ee457a55\",\"lessThan\":\"e03513f58919d9e2bc6df765ca2c9da863d03d90\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1b97871b501f1bac0fd39a073c4c8473ee457a55\",\"lessThan\":\"2a19b28f7929866e1cec92a3619f4de9f2d20005\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"block/blk-core.c\",\"block/blk-mq.c\",\"block/blk-mq.h\",\"block/blk-sysfs.c\",\"block/genhd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.6\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-10T18:51:40.130772Z\",\"id\":\"CVE-2021-47552\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.15.6\",\"matchCriteriaId\":\"8A9D3A0C-7C16-4DE1-9115-F24F38C1D07F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"357AA433-37E8-4323-BFB2-3038D6E4B414\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2a19b28f7929866e1cec92a3619f4de9f2d20005\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e03513f58919d9e2bc6df765ca2c9da863d03d90\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2a19b28f7929866e1cec92a3619f4de9f2d20005\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e03513f58919d9e2bc6df765ca2c9da863d03d90\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-04T19:56:57+00:00",
"cve": "CVE-2021-47552",
"id": "CVE-2021-47552",
"initial_release_date": "2021-01-01T00:00:00+00:00",
"product_status:known_affected": "76",
"product_status:known_not_affected": "122",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47552.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-11T02:37:09Z",
"cve": "CVE-2021-47552",
"id": "CVE-2021-47552",
"initial_release_date": "2024-05-28T15:29:27Z",
"product_status:known_affected": "382",
"product_status:known_not_affected": "326",
"product_status:recommended": "313",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2021-47552",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47552.json",
"version": "70"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e03513f58919d9e2bc6df765ca2c9da863d03d90\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2a19b28f7929866e1cec92a3619f4de9f2d20005\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:39:59.804Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47552\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-10T18:51:40.130772Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-10T18:51:47.272Z\"}}], \"cna\": {\"title\": \"blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached through local block-layer teardown (SCSI device removal / disk_release / blk_cleanup_queue), for example via sysfs delete, module unload, or removable USB storage power-off\\u2014not via network packet processing.\\nAC:L - An attacker who can issue I/O (scheduling hctx-\u003erun_work) and then remove the device controls both sides of the lifetime gap; the pending dispatch work reliably runs after scsi_device is freed because cancel was deferred to blk_release_queue.\\nPR:L - A normal local user can trigger removal of removable SCSI/USB block devices they are allowed to use (e.g. desktop seat polkit/udisks \\u201cpower off\\u201d), without needing real init-namespace root or userns-unreachable capabilities.\\nUI:N - The attacker performs I/O and device removal themselves; no separate victim action is required.\\nS:U - Impact stays within the local kernel/host authority (UAF in blk-mq/SCSI), with no VM/IOMMU/sandbox boundary crossing.\\nC:H - q-\u003equeuedata remains a dangling pointer to the freed scsi_device while dispatch work can still call scsi_mq_get_budget/sbitmap_get; that UAF can be sprayed to obtain arbitrary kernel read primitives.\\nI:H - The same post-free scsi_device/sbitmap object is attacker-controllable via heap spray, enabling corrupted map pointers and write/control-flow primitives through the dispatch get_budget path.\\nA:H - The reported failure is a kernel NULL deref/oops in sbitmap_get from kblockd (and any UAF here can equally crash the kernel), so availability impact is high.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1b97871b501f1bac0fd39a073c4c8473ee457a55\", \"lessThan\": \"e03513f58919d9e2bc6df765ca2c9da863d03d90\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1b97871b501f1bac0fd39a073c4c8473ee457a55\", \"lessThan\": \"2a19b28f7929866e1cec92a3619f4de9f2d20005\", \"versionType\": \"git\"}], \"programFiles\": [\"block/blk-core.c\", \"block/blk-mq.c\", \"block/blk-mq.h\", \"block/blk-sysfs.c\", \"block/genhd.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"block/blk-core.c\", \"block/blk-mq.c\", \"block/blk-mq.h\", \"block/blk-sysfs.c\", \"block/genhd.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e03513f58919d9e2bc6df765ca2c9da863d03d90\"}, {\"url\": \"https://git.kernel.org/stable/c/2a19b28f7929866e1cec92a3619f4de9f2d20005\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()\\n\\nFor avoiding to slow down queue destroy, we don\u0027t call\\nblk_mq_quiesce_queue() in blk_cleanup_queue(), instead of delaying to\\ncancel dispatch work in blk_release_queue().\\n\\nHowever, this way has caused kernel oops[1], reported by Changhui. The log\\nshows that scsi_device can be freed before running blk_release_queue(),\\nwhich is expected too since scsi_device is released after the scsi disk\\nis closed and the scsi_device is removed.\\n\\nFixes the issue by canceling blk-mq dispatch work in both blk_cleanup_queue()\\nand disk_release():\\n\\n1) when disk_release() is run, the disk has been closed, and any sync\\ndispatch activities have been done, so canceling dispatch work is enough to\\nquiesce filesystem I/O dispatch activity.\\n\\n2) in blk_cleanup_queue(), we only focus on passthrough request, and\\npassthrough request is always explicitly allocated \u0026 freed by\\nits caller, so once queue is frozen, all sync dispatch activity\\nfor passthrough request has been done, then it is enough to just cancel\\ndispatch work for avoiding any dispatch activity.\\n\\n[1] kernel panic log\\n[12622.769416] BUG: kernel NULL pointer dereference, address: 0000000000000300\\n[12622.777186] #PF: supervisor read access in kernel mode\\n[12622.782918] #PF: error_code(0x0000) - not-present page\\n[12622.788649] PGD 0 P4D 0\\n[12622.791474] Oops: 0000 [#1] PREEMPT SMP PTI\\n[12622.796138] CPU: 10 PID: 744 Comm: kworker/10:1H Kdump: loaded Not tainted 5.15.0+ #1\\n[12622.804877] Hardware name: Dell Inc. PowerEdge R730/0H21J3, BIOS 1.5.4 10/002/2015\\n[12622.813321] Workqueue: kblockd blk_mq_run_work_fn\\n[12622.818572] RIP: 0010:sbitmap_get+0x75/0x190\\n[12622.823336] Code: 85 80 00 00 00 41 8b 57 08 85 d2 0f 84 b1 00 00 00 45 31 e4 48 63 cd 48 8d 1c 49 48 c1 e3 06 49 03 5f 10 4c 8d 6b 40 83 f0 01 \u003c48\u003e 8b 33 44 89 f2 4c 89 ef 0f b6 c8 e8 fa f3 ff ff 83 f8 ff 75 58\\n[12622.844290] RSP: 0018:ffffb00a446dbd40 EFLAGS: 00010202\\n[12622.850120] RAX: 0000000000000001 RBX: 0000000000000300 RCX: 0000000000000004\\n[12622.858082] RDX: 0000000000000006 RSI: 0000000000000082 RDI: ffffa0b7a2dfe030\\n[12622.866042] RBP: 0000000000000004 R08: 0000000000000001 R09: ffffa0b742721334\\n[12622.874003] R10: 0000000000000008 R11: 0000000000000008 R12: 0000000000000000\\n[12622.881964] R13: 0000000000000340 R14: 0000000000000000 R15: ffffa0b7a2dfe030\\n[12622.889926] FS: 0000000000000000(0000) GS:ffffa0baafb40000(0000) knlGS:0000000000000000\\n[12622.898956] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[12622.905367] CR2: 0000000000000300 CR3: 0000000641210001 CR4: 00000000001706e0\\n[12622.913328] Call Trace:\\n[12622.916055] \u003cTASK\u003e\\n[12622.918394] scsi_mq_get_budget+0x1a/0x110\\n[12622.922969] __blk_mq_do_dispatch_sched+0x1d4/0x320\\n[12622.928404] ? pick_next_task_fair+0x39/0x390\\n[12622.933268] __blk_mq_sched_dispatch_requests+0xf4/0x140\\n[12622.939194] blk_mq_sched_dispatch_requests+0x30/0x60\\n[12622.944829] __blk_mq_run_hw_queue+0x30/0xa0\\n[12622.949593] process_one_work+0x1e8/0x3c0\\n[12622.954059] worker_thread+0x50/0x3b0\\n[12622.958144] ? rescuer_thread+0x370/0x370\\n[12622.962616] kthread+0x158/0x180\\n[12622.966218] ? set_kthread_struct+0x40/0x40\\n[12622.970884] ret_from_fork+0x22/0x30\\n[12622.974875] \u003c/TASK\u003e\\n[12622.977309] Modules linked in: scsi_debug rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs sunrpc dm_multipath intel_rapl_msr intel_rapl_common dell_wmi_descriptor sb_edac rfkill video x86_pkg_temp_thermal intel_powerclamp dcdbas coretemp kvm_intel kvm mgag200 irqbypass i2c_algo_bit rapl drm_kms_helper ipmi_ssif intel_cstate intel_uncore syscopyarea sysfillrect sysimgblt fb_sys_fops pcspkr cec mei_me lpc_ich mei ipmi_si ipmi_devintf ipmi_msghandler acpi_power_meter drm fuse xfs libcrc32c sr_mod cdrom sd_mod t10_pi sg ixgbe ahci libahci crct10dif_pclmul crc32_pclmul crc32c_intel libata megaraid_sas ghash_clmulni_intel tg3 wdat_w\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.6\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"5.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:48:22.040Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2021-47552\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:48:22.040Z\", \"dateReserved\": \"2024-05-24T15:02:54.832Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-24T15:09:55.295Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…