GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-46921 (GCVE-0-2021-46921)

Vulnerability from cvelistv5 – Published: 2024-02-27 09:36 – Updated: 2026-08-05 08:45
VLAI
Title
locking/qrwlock: Fix ordering in queued_write_lock_slowpath()
Summary
In the Linux kernel, the following vulnerability has been resolved: locking/qrwlock: Fix ordering in queued_write_lock_slowpath() While this code is executed with the wait_lock held, a reader can acquire the lock without holding wait_lock. The writer side loops checking the value with the atomic_cond_read_acquire(), but only truly acquires the lock when the compare-and-exchange is completed successfully which isn’t ordered. This exposes the window between the acquire and the cmpxchg to an A-B-A problem which allows reads following the lock acquisition to observe values speculatively before the write lock is truly acquired. We've seen a problem in epoll where the reader does a xchg while holding the read lock, but the writer can see a value change out from under it. Writer | Reader -------------------------------------------------------------------------------- ep_scan_ready_list() | |- write_lock_irq() | |- queued_write_lock_slowpath() | |- atomic_cond_read_acquire() | | read_lock_irqsave(&ep->lock, flags); --> (observes value before unlock) | chain_epi_lockless() | | epi->next = xchg(&ep->ovflist, epi); | | read_unlock_irqrestore(&ep->lock, flags); | | | atomic_cmpxchg_relaxed() | |-- READ_ONCE(ep->ovflist); | A core can order the read of the ovflist ahead of the atomic_cmpxchg_relaxed(). Switching the cmpxchg to use acquire semantics addresses this issue at which point the atomic_cond_read can be switched to use relaxed semantics. [peterz: use try_cmpxchg()]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-27 16:11 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b519b56e378ee82caf9b079b04f5db87dedc3251 , < 5902f9453a313be8fe78cbd7e7ca9dba9319fc6e (git)
Affected: b519b56e378ee82caf9b079b04f5db87dedc3251 , < 82808cc026811fbc3ecf0c0b267a12a339eead56 (git)
Affected: b519b56e378ee82caf9b079b04f5db87dedc3251 , < 82fa9ced35d88581cffa4a1c856fc41fca96d80a (git)
Affected: b519b56e378ee82caf9b079b04f5db87dedc3251 , < d558fcdb17139728347bccc60a16af3e639649d2 (git)
Affected: b519b56e378ee82caf9b079b04f5db87dedc3251 , < 84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.15
Unaffected: 0 , < 4.15 (semver)
Unaffected: 4.19.189 , ≤ 4.19.* (semver)
Unaffected: 5.4.115 , ≤ 5.4.* (semver)
Unaffected: 5.10.33 , ≤ 5.10.* (semver)
Unaffected: 5.11.17 , ≤ 5.11.* (semver)
Unaffected: 5.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-46921",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-27T16:11:46.310286Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:22:01.427Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:17:42.848Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/locking/qrwlock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5902f9453a313be8fe78cbd7e7ca9dba9319fc6e",
              "status": "affected",
              "version": "b519b56e378ee82caf9b079b04f5db87dedc3251",
              "versionType": "git"
            },
            {
              "lessThan": "82808cc026811fbc3ecf0c0b267a12a339eead56",
              "status": "affected",
              "version": "b519b56e378ee82caf9b079b04f5db87dedc3251",
              "versionType": "git"
            },
            {
              "lessThan": "82fa9ced35d88581cffa4a1c856fc41fca96d80a",
              "status": "affected",
              "version": "b519b56e378ee82caf9b079b04f5db87dedc3251",
              "versionType": "git"
            },
            {
              "lessThan": "d558fcdb17139728347bccc60a16af3e639649d2",
              "status": "affected",
              "version": "b519b56e378ee82caf9b079b04f5db87dedc3251",
              "versionType": "git"
            },
            {
              "lessThan": "84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896",
              "status": "affected",
              "version": "b519b56e378ee82caf9b079b04f5db87dedc3251",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/locking/qrwlock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.115",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.11.*",
              "status": "unaffected",
              "version": "5.11.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.189",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.115",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.33",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.17",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/qrwlock: Fix ordering in queued_write_lock_slowpath()\n\nWhile this code is executed with the wait_lock held, a reader can\nacquire the lock without holding wait_lock.  The writer side loops\nchecking the value with the atomic_cond_read_acquire(), but only truly\nacquires the lock when the compare-and-exchange is completed\nsuccessfully which isn\u2019t ordered. This exposes the window between the\nacquire and the cmpxchg to an A-B-A problem which allows reads\nfollowing the lock acquisition to observe values speculatively before\nthe write lock is truly acquired.\n\nWe\u0027ve seen a problem in epoll where the reader does a xchg while\nholding the read lock, but the writer can see a value change out from\nunder it.\n\n  Writer                                | Reader\n  --------------------------------------------------------------------------------\n  ep_scan_ready_list()                  |\n  |- write_lock_irq()                   |\n      |- queued_write_lock_slowpath()   |\n\t|- atomic_cond_read_acquire()   |\n\t\t\t\t        | read_lock_irqsave(\u0026ep-\u003elock, flags);\n     --\u003e (observes value before unlock) |  chain_epi_lockless()\n     |                                  |    epi-\u003enext = xchg(\u0026ep-\u003eovflist, epi);\n     |                                  | read_unlock_irqrestore(\u0026ep-\u003elock, flags);\n     |                                  |\n     |     atomic_cmpxchg_relaxed()     |\n     |-- READ_ONCE(ep-\u003eovflist);        |\n\nA core can order the read of the ovflist ahead of the\natomic_cmpxchg_relaxed(). Switching the cmpxchg to use acquire\nsemantics addresses this issue at which point the atomic_cond_read can\nbe switched to use relaxed semantics.\n\n[peterz: use try_cmpxchg()]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in queued_write_lock_slowpath() for rwlock_t; the demonstrated path is local epoll_wait \u2192 ep_send_events \u2192 ep_done_scan \u2192 write_lock_irq(), which requires local syscall access rather than network or physical reachability.\nAC:L - An unprivileged attacker can drive both sides of the race (epoll_wait as writer and concurrent fd events triggering ep_poll_callback as reader), forcing lock contention into the slowpath; Amazon observed this ordering failure in production on ARM, so success is not dependent on victim-controlled conditions.\nPR:L - epoll_create/epoll_ctl/epoll_wait and ordinary process activity that take rwlocks are available to unprivileged local users with no capabilities or user-namespace privilege escalation required.\nUI:N - Exploitation requires only attacker-controlled threads and file descriptors; no separate victim action such as mounting a filesystem or opening a crafted file is needed.\nS:U - Impact remains within the host kernel\u0027s privilege boundary (incorrect mutual exclusion and resulting memory/state corruption), with no VM-escape or other cross-authority scope change.\nC:H - Missing acquire semantics let a writer observe shared kernel state before the write lock is truly held, so protected structures (e.g. ep-\u003eovflist and any other rwlock-guarded data) can be read incorrectly; as a generic rwlock break this enables broad kernel info disclosure via corrupted/racy structure access.\nI:H - The writer then mutates state based on that stale view (e.g. ep_done_scan writing EP_UNACTIVE_PTR over an overflow chain it missed), and broken write-lock exclusivity on widely used rwlocks such as tasklist_lock can corrupt kernel pointer-rich structures, enabling integrity loss and control-flow primitives.\nA:H - Data races from broken qrwlock acquire on structures protected by rwlock_t (epoll lists, tasklist, and others on ARM64/Android) can yield list corruption, use-after-free, and kernel oops/panic under attacker-triggered contention."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:45:05.258Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56"
        },
        {
          "url": "https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896"
        }
      ],
      "title": "locking/qrwlock: Fix ordering in queued_write_lock_slowpath()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-46921",
    "datePublished": "2024-02-27T09:36:26.461Z",
    "dateReserved": "2024-02-25T13:45:52.719Z",
    "dateUpdated": "2026-08-05T08:45:05.258Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-46921",
      "date": "2026-09-15",
      "epss": "0.00235",
      "percentile": "0.14603"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.15.0\", \"versionEndExcluding\": \"4.19.189\", \"matchCriteriaId\": \"8EEE5714-B0F5-40FB-9A6E-4BF3F2A51B2E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.20.0\", \"versionEndExcluding\": \"5.4.115\", \"matchCriteriaId\": \"CC57D065-3933-4083-BA07-817D4CBF8157\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5.0\", \"versionEndExcluding\": \"5.10.33\", \"matchCriteriaId\": \"995EF7FE-8C8F-470B-8214-BC0C68B162C3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11.0\", \"versionEndExcluding\": \"5.11.17\", \"matchCriteriaId\": \"6C74925C-5E45-4C6F-9E47-653DC5ACBE9E\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlocking/qrwlock: Fix ordering in queued_write_lock_slowpath()\\n\\nWhile this code is executed with the wait_lock held, a reader can\\nacquire the lock without holding wait_lock.  The writer side loops\\nchecking the value with the atomic_cond_read_acquire(), but only truly\\nacquires the lock when the compare-and-exchange is completed\\nsuccessfully which isn\\u2019t ordered. This exposes the window between the\\nacquire and the cmpxchg to an A-B-A problem which allows reads\\nfollowing the lock acquisition to observe values speculatively before\\nthe write lock is truly acquired.\\n\\nWe\u0027ve seen a problem in epoll where the reader does a xchg while\\nholding the read lock, but the writer can see a value change out from\\nunder it.\\n\\n  Writer                                | Reader\\n  --------------------------------------------------------------------------------\\n  ep_scan_ready_list()                  |\\n  |- write_lock_irq()                   |\\n      |- queued_write_lock_slowpath()   |\\n\\t|- atomic_cond_read_acquire()   |\\n\\t\\t\\t\\t        | read_lock_irqsave(\u0026ep-\u003elock, flags);\\n     --\u003e (observes value before unlock) |  chain_epi_lockless()\\n     |                                  |    epi-\u003enext = xchg(\u0026ep-\u003eovflist, epi);\\n     |                                  | read_unlock_irqrestore(\u0026ep-\u003elock, flags);\\n     |                                  |\\n     |     atomic_cmpxchg_relaxed()     |\\n     |-- READ_ONCE(ep-\u003eovflist);        |\\n\\nA core can order the read of the ovflist ahead of the\\natomic_cmpxchg_relaxed(). Switching the cmpxchg to use acquire\\nsemantics addresses this issue at which point the atomic_cond_read can\\nbe switched to use relaxed semantics.\\n\\n[peterz: use try_cmpxchg()]\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: lock/qrwlock: corrige el orden en queued_write_lock_slowpath() Mientras este c\\u00f3digo se ejecuta con wait_lock retenido, un lector puede adquirir el bloqueo sin mantener wait_lock. El lado del escritor realiza un bucle para verificar el valor con atomic_cond_read_acquire(), pero solo adquiere realmente el bloqueo cuando la comparaci\\u00f3n e intercambio se completa con \\u00e9xito, lo cual no est\\u00e1 ordenado. Esto expone la ventana entre la adquisici\\u00f3n y el cmpxchg a un problema ABA que permite que las lecturas posteriores a la adquisici\\u00f3n del bloqueo observen los valores de forma especulativa antes de que se adquiera realmente el bloqueo de escritura. Hemos visto un problema en epoll donde el lector realiza un xchg mientras mantiene el bloqueo de lectura, pero el escritor puede ver un cambio de valor debajo de \\u00e9l. Escritor | Lector ------------------------------------------------- ------------------------------- ep_scan_ready_list() | |- write_lock_irq() | |- queued_write_lock_slowpath() | |- atomic_cond_read_acquire() | | read_lock_irqsave(\u0026amp;ep-\u0026gt;bloquear, banderas); --\u0026gt; (observa el valor antes de desbloquear) | cadena_epi_lockless() | | epi-\u0026gt;siguiente = xchg(\u0026amp;ep-\u0026gt;ovflist, epi); | | read_unlock_irqrestore(\u0026amp;ep-\u0026gt;bloquear, banderas); | | | atomic_cmpxchg_relaxed() | |-- READ_ONCE(ep-\u0026gt;ovflist); | Un n\\u00facleo puede ordenar la lectura de ovflist antes de atomic_cmpxchg_relaxed(). Cambiar cmpxchg para usar la sem\\u00e1ntica de adquisici\\u00f3n soluciona este problema, momento en el que atomic_cond_read se puede cambiar para usar una sem\\u00e1ntica relajada. [peterz: utilice try_cmpxchg()]\"}]",
      "id": "CVE-2021-46921",
      "lastModified": "2024-11-21T06:34:56.260",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-02-27T10:15:06.990",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-668\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-46921\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-02-27T10:15:06.990\",\"lastModified\":\"2026-08-04T10:16:36.567\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlocking/qrwlock: Fix ordering in queued_write_lock_slowpath()\\n\\nWhile this code is executed with the wait_lock held, a reader can\\nacquire the lock without holding wait_lock.  The writer side loops\\nchecking the value with the atomic_cond_read_acquire(), but only truly\\nacquires the lock when the compare-and-exchange is completed\\nsuccessfully which isn\u2019t ordered. This exposes the window between the\\nacquire and the cmpxchg to an A-B-A problem which allows reads\\nfollowing the lock acquisition to observe values speculatively before\\nthe write lock is truly acquired.\\n\\nWe\u0027ve seen a problem in epoll where the reader does a xchg while\\nholding the read lock, but the writer can see a value change out from\\nunder it.\\n\\n  Writer                                | Reader\\n  --------------------------------------------------------------------------------\\n  ep_scan_ready_list()                  |\\n  |- write_lock_irq()                   |\\n      |- queued_write_lock_slowpath()   |\\n\\t|- atomic_cond_read_acquire()   |\\n\\t\\t\\t\\t        | read_lock_irqsave(\u0026ep-\u003elock, flags);\\n     --\u003e (observes value before unlock) |  chain_epi_lockless()\\n     |                                  |    epi-\u003enext = xchg(\u0026ep-\u003eovflist, epi);\\n     |                                  | read_unlock_irqrestore(\u0026ep-\u003elock, flags);\\n     |                                  |\\n     |     atomic_cmpxchg_relaxed()     |\\n     |-- READ_ONCE(ep-\u003eovflist);        |\\n\\nA core can order the read of the ovflist ahead of the\\natomic_cmpxchg_relaxed(). Switching the cmpxchg to use acquire\\nsemantics addresses this issue at which point the atomic_cond_read can\\nbe switched to use relaxed semantics.\\n\\n[peterz: use try_cmpxchg()]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: lock/qrwlock: corrige el orden en queued_write_lock_slowpath() Mientras este c\u00f3digo se ejecuta con wait_lock retenido, un lector puede adquirir el bloqueo sin mantener wait_lock. El lado del escritor realiza un bucle para verificar el valor con atomic_cond_read_acquire(), pero solo adquiere realmente el bloqueo cuando la comparaci\u00f3n e intercambio se completa con \u00e9xito, lo cual no est\u00e1 ordenado. Esto expone la ventana entre la adquisici\u00f3n y el cmpxchg a un problema ABA que permite que las lecturas posteriores a la adquisici\u00f3n del bloqueo observen los valores de forma especulativa antes de que se adquiera realmente el bloqueo de escritura. Hemos visto un problema en epoll donde el lector realiza un xchg mientras mantiene el bloqueo de lectura, pero el escritor puede ver un cambio de valor debajo de \u00e9l. Escritor | Lector ------------------------------------------------- ------------------------------- ep_scan_ready_list() | |- write_lock_irq() | |- queued_write_lock_slowpath() | |- atomic_cond_read_acquire() | | read_lock_irqsave(\u0026amp;ep-\u0026gt;bloquear, banderas); --\u0026gt; (observa el valor antes de desbloquear) | cadena_epi_lockless() | | epi-\u0026gt;siguiente = xchg(\u0026amp;ep-\u0026gt;ovflist, epi); | | read_unlock_irqrestore(\u0026amp;ep-\u0026gt;bloquear, banderas); | | | atomic_cmpxchg_relaxed() | |-- READ_ONCE(ep-\u0026gt;ovflist); | Un n\u00facleo puede ordenar la lectura de ovflist antes de atomic_cmpxchg_relaxed(). Cambiar cmpxchg para usar la sem\u00e1ntica de adquisici\u00f3n soluciona este problema, momento en el que atomic_cond_read se puede cambiar para usar una sem\u00e1ntica relajada. [peterz: utilice try_cmpxchg()]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/locking/qrwlock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b519b56e378ee82caf9b079b04f5db87dedc3251\",\"lessThan\":\"5902f9453a313be8fe78cbd7e7ca9dba9319fc6e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b519b56e378ee82caf9b079b04f5db87dedc3251\",\"lessThan\":\"82808cc026811fbc3ecf0c0b267a12a339eead56\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b519b56e378ee82caf9b079b04f5db87dedc3251\",\"lessThan\":\"82fa9ced35d88581cffa4a1c856fc41fca96d80a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b519b56e378ee82caf9b079b04f5db87dedc3251\",\"lessThan\":\"d558fcdb17139728347bccc60a16af3e639649d2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b519b56e378ee82caf9b079b04f5db87dedc3251\",\"lessThan\":\"84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/locking/qrwlock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.189\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.115\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.33\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.11.17\",\"lessThanOrEqual\":\"5.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-02-27T16:11:46.310286Z\",\"id\":\"CVE-2021-46921\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-668\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15.0\",\"versionEndExcluding\":\"4.19.189\",\"matchCriteriaId\":\"8EEE5714-B0F5-40FB-9A6E-4BF3F2A51B2E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20.0\",\"versionEndExcluding\":\"5.4.115\",\"matchCriteriaId\":\"CC57D065-3933-4083-BA07-817D4CBF8157\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5.0\",\"versionEndExcluding\":\"5.10.33\",\"matchCriteriaId\":\"995EF7FE-8C8F-470B-8214-BC0C68B162C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11.0\",\"versionEndExcluding\":\"5.11.17\",\"matchCriteriaId\":\"6C74925C-5E45-4C6F-9E47-653DC5ACBE9E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:10:22+00:00",
      "cve": "CVE-2021-46921",
      "id": "CVE-2021-46921",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "108",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: locking/qrwlock: Fix ordering in queued_write_lock_slowpath()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-46921.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T02:21:06Z",
      "cve": "CVE-2021-46921",
      "id": "CVE-2021-46921",
      "initial_release_date": "2024-06-04T12:53:23Z",
      "product_status:known_affected": "460",
      "product_status:known_not_affected": "163",
      "product_status:recommended": "207",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-46921",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-46921.json",
      "version": "54"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:17:42.848Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-46921\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-02-27T16:11:46.310286Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-05T15:20:40.966Z\"}}], \"cna\": {\"title\": \"locking/qrwlock: Fix ordering in queued_write_lock_slowpath()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is in queued_write_lock_slowpath() for rwlock_t; the demonstrated path is local epoll_wait \\u2192 ep_send_events \\u2192 ep_done_scan \\u2192 write_lock_irq(), which requires local syscall access rather than network or physical reachability.\\nAC:L - An unprivileged attacker can drive both sides of the race (epoll_wait as writer and concurrent fd events triggering ep_poll_callback as reader), forcing lock contention into the slowpath; Amazon observed this ordering failure in production on ARM, so success is not dependent on victim-controlled conditions.\\nPR:L - epoll_create/epoll_ctl/epoll_wait and ordinary process activity that take rwlocks are available to unprivileged local users with no capabilities or user-namespace privilege escalation required.\\nUI:N - Exploitation requires only attacker-controlled threads and file descriptors; no separate victim action such as mounting a filesystem or opening a crafted file is needed.\\nS:U - Impact remains within the host kernel\u0027s privilege boundary (incorrect mutual exclusion and resulting memory/state corruption), with no VM-escape or other cross-authority scope change.\\nC:H - Missing acquire semantics let a writer observe shared kernel state before the write lock is truly held, so protected structures (e.g. ep-\u003eovflist and any other rwlock-guarded data) can be read incorrectly; as a generic rwlock break this enables broad kernel info disclosure via corrupted/racy structure access.\\nI:H - The writer then mutates state based on that stale view (e.g. ep_done_scan writing EP_UNACTIVE_PTR over an overflow chain it missed), and broken write-lock exclusivity on widely used rwlocks such as tasklist_lock can corrupt kernel pointer-rich structures, enabling integrity loss and control-flow primitives.\\nA:H - Data races from broken qrwlock acquire on structures protected by rwlock_t (epoll lists, tasklist, and others on ARM64/Android) can yield list corruption, use-after-free, and kernel oops/panic under attacker-triggered contention.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b519b56e378ee82caf9b079b04f5db87dedc3251\", \"lessThan\": \"5902f9453a313be8fe78cbd7e7ca9dba9319fc6e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b519b56e378ee82caf9b079b04f5db87dedc3251\", \"lessThan\": \"82808cc026811fbc3ecf0c0b267a12a339eead56\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b519b56e378ee82caf9b079b04f5db87dedc3251\", \"lessThan\": \"82fa9ced35d88581cffa4a1c856fc41fca96d80a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b519b56e378ee82caf9b079b04f5db87dedc3251\", \"lessThan\": \"d558fcdb17139728347bccc60a16af3e639649d2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b519b56e378ee82caf9b079b04f5db87dedc3251\", \"lessThan\": \"84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/locking/qrwlock.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.189\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.115\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.11.17\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.11.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/locking/qrwlock.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e\"}, {\"url\": \"https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56\"}, {\"url\": \"https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a\"}, {\"url\": \"https://git.kernel.org/stable/c/d558fcdb17139728347bccc60a16af3e639649d2\"}, {\"url\": \"https://git.kernel.org/stable/c/84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlocking/qrwlock: Fix ordering in queued_write_lock_slowpath()\\n\\nWhile this code is executed with the wait_lock held, a reader can\\nacquire the lock without holding wait_lock.  The writer side loops\\nchecking the value with the atomic_cond_read_acquire(), but only truly\\nacquires the lock when the compare-and-exchange is completed\\nsuccessfully which isn\\u2019t ordered. This exposes the window between the\\nacquire and the cmpxchg to an A-B-A problem which allows reads\\nfollowing the lock acquisition to observe values speculatively before\\nthe write lock is truly acquired.\\n\\nWe\u0027ve seen a problem in epoll where the reader does a xchg while\\nholding the read lock, but the writer can see a value change out from\\nunder it.\\n\\n  Writer                                | Reader\\n  --------------------------------------------------------------------------------\\n  ep_scan_ready_list()                  |\\n  |- write_lock_irq()                   |\\n      |- queued_write_lock_slowpath()   |\\n\\t|- atomic_cond_read_acquire()   |\\n\\t\\t\\t\\t        | read_lock_irqsave(\u0026ep-\u003elock, flags);\\n     --\u003e (observes value before unlock) |  chain_epi_lockless()\\n     |                                  |    epi-\u003enext = xchg(\u0026ep-\u003eovflist, epi);\\n     |                                  | read_unlock_irqrestore(\u0026ep-\u003elock, flags);\\n     |                                  |\\n     |     atomic_cmpxchg_relaxed()     |\\n     |-- READ_ONCE(ep-\u003eovflist);        |\\n\\nA core can order the read of the ovflist ahead of the\\natomic_cmpxchg_relaxed(). Switching the cmpxchg to use acquire\\nsemantics addresses this issue at which point the atomic_cond_read can\\nbe switched to use relaxed semantics.\\n\\n[peterz: use try_cmpxchg()]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.189\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.115\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.33\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.11.17\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12\", \"versionStartIncluding\": \"4.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:45:05.258Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-46921\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:45:05.258Z\", \"dateReserved\": \"2024-02-25T13:45:52.719Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-02-27T09:36:26.461Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.