GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47296 (GCVE-0-2021-47296)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:35 – Updated: 2026-08-05 08:47
VLAI
Title
KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak vcpu_put is not called if the user copy fails. This can result in preempt notifier corruption and crashes, among other issues.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-28 19:22 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b3cebfe8c1cadf1817939dcc3688a2504a69c662 , < 9bafc34dc4ad0cef18727c557f21ed3c3304df50 (git)
Affected: b3cebfe8c1cadf1817939dcc3688a2504a69c662 , < f38527f1890543cdfca8dfd06f75f9887cce6151 (git)
Affected: b3cebfe8c1cadf1817939dcc3688a2504a69c662 , < e14ef1095387f764d95614d3ec9e4d07c82a3533 (git)
Affected: b3cebfe8c1cadf1817939dcc3688a2504a69c662 , < a4a488915feaad38345cc01b80d52e8200ff5209 (git)
Affected: b3cebfe8c1cadf1817939dcc3688a2504a69c662 , < bc4188a2f56e821ea057aca6bf444e138d06c252 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.18
Unaffected: 0 , < 4.18 (semver)
Unaffected: 4.19.199 , ≤ 4.19.* (semver)
Unaffected: 5.4.136 , ≤ 5.4.* (semver)
Unaffected: 5.10.54 , ≤ 5.10.* (semver)
Unaffected: 5.13.6 , ≤ 5.13.* (semver)
Unaffected: 5.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47296",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-28T19:22:38.048038Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:14:24.621Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.371Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9bafc34dc4ad0cef18727c557f21ed3c3304df50"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f38527f1890543cdfca8dfd06f75f9887cce6151"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e14ef1095387f764d95614d3ec9e4d07c82a3533"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a4a488915feaad38345cc01b80d52e8200ff5209"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bc4188a2f56e821ea057aca6bf444e138d06c252"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/kvm/powerpc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9bafc34dc4ad0cef18727c557f21ed3c3304df50",
              "status": "affected",
              "version": "b3cebfe8c1cadf1817939dcc3688a2504a69c662",
              "versionType": "git"
            },
            {
              "lessThan": "f38527f1890543cdfca8dfd06f75f9887cce6151",
              "status": "affected",
              "version": "b3cebfe8c1cadf1817939dcc3688a2504a69c662",
              "versionType": "git"
            },
            {
              "lessThan": "e14ef1095387f764d95614d3ec9e4d07c82a3533",
              "status": "affected",
              "version": "b3cebfe8c1cadf1817939dcc3688a2504a69c662",
              "versionType": "git"
            },
            {
              "lessThan": "a4a488915feaad38345cc01b80d52e8200ff5209",
              "status": "affected",
              "version": "b3cebfe8c1cadf1817939dcc3688a2504a69c662",
              "versionType": "git"
            },
            {
              "lessThan": "bc4188a2f56e821ea057aca6bf444e138d06c252",
              "status": "affected",
              "version": "b3cebfe8c1cadf1817939dcc3688a2504a69c662",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/kvm/powerpc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.13.*",
              "status": "unaffected",
              "version": "5.13.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.199",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.136",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.54",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13.6",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak\n\nvcpu_put is not called if the user copy fails. This can result in preempt\nnotifier corruption and crashes, among other issues."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggered via local host ioctls on a KVM vCPU fd (/dev/kvm \u2192 KVM_CREATE_VM \u2192 KVM_CREATE_VCPU \u2192 KVM_ENABLE_CAP/KVM_DIRTY_TLB), not via network packets or unaided guest execution.\nAC:L - The attacker reliably forces the bug by passing an invalid userspace pointer so copy_from_user fails after vcpu_load; no race or attacker-independent condition is required.\nPR:L - The ioctl path has no capable() check; access needs only /dev/kvm permissions (kvm group or equivalent device access), which is unprivileged rather than init-namespace root.\nUI:N - The attacker triggers the leak directly with their own KVM ioctls; no separate victim action is required.\nS:U - This is host userspace (VMM) corrupting host kernel state via the KVM ioctl interface, not a guest-to-host escape across a VM security boundary.\nC:H - Leaked preempt_notifier remains linked after vcpu free (kvm_destroy_vcpus), yielding a use-after-free of the vcpu object whose sprayed contents can disclose kernel memory when sched_in/out runs.\nI:H - UAF of the embedded preempt_notifier (including the ops pointer) and double-register hlist corruption enable heap corruption and control-flow hijack when notifier callbacks fire.\nA:H - Double preempt_notifier_register creates a self-referential hlist that infinite-loops in the scheduler, and the UAF/corruption paths cause kernel oops, hang, or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:47:08.193Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9bafc34dc4ad0cef18727c557f21ed3c3304df50"
        },
        {
          "url": "https://git.kernel.org/stable/c/f38527f1890543cdfca8dfd06f75f9887cce6151"
        },
        {
          "url": "https://git.kernel.org/stable/c/e14ef1095387f764d95614d3ec9e4d07c82a3533"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4a488915feaad38345cc01b80d52e8200ff5209"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc4188a2f56e821ea057aca6bf444e138d06c252"
        }
      ],
      "title": "KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47296",
    "datePublished": "2024-05-21T14:35:19.341Z",
    "dateReserved": "2024-05-21T13:27:52.130Z",
    "dateUpdated": "2026-08-05T08:47:08.193Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47296",
      "date": "2026-09-19",
      "epss": "0.00234",
      "percentile": "0.14617"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak\n\nvcpu_put is not called if the user copy fails. This can result in preempt\nnotifier corruption and crashes, among other issues."
        },
        {
          "lang": "es",
          "value": " En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: PPC: correcci\u00f3n de fuga de kvm_arch_vcpu_ioctl vcpu_load. No se llama a vcpu_put si falla la copia del usuario. Esto puede provocar da\u00f1os y bloqueos del notificador preventivo, entre otros problemas."
        }
      ],
      "id": "CVE-2021-47296",
      "lastModified": "2024-11-21T06:35:49.233",
      "published": "2024-05-21T15:15:17.477",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/9bafc34dc4ad0cef18727c557f21ed3c3304df50"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/a4a488915feaad38345cc01b80d52e8200ff5209"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/bc4188a2f56e821ea057aca6bf444e138d06c252"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/e14ef1095387f764d95614d3ec9e4d07c82a3533"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/f38527f1890543cdfca8dfd06f75f9887cce6151"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/9bafc34dc4ad0cef18727c557f21ed3c3304df50"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/a4a488915feaad38345cc01b80d52e8200ff5209"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/bc4188a2f56e821ea057aca6bf444e138d06c252"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/e14ef1095387f764d95614d3ec9e4d07c82a3533"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/f38527f1890543cdfca8dfd06f75f9887cce6151"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/powerpc/kvm/powerpc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "9bafc34dc4ad0cef18727c557f21ed3c3304df50",
                    "status": "affected",
                    "version": "b3cebfe8c1cadf1817939dcc3688a2504a69c662",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f38527f1890543cdfca8dfd06f75f9887cce6151",
                    "status": "affected",
                    "version": "b3cebfe8c1cadf1817939dcc3688a2504a69c662",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e14ef1095387f764d95614d3ec9e4d07c82a3533",
                    "status": "affected",
                    "version": "b3cebfe8c1cadf1817939dcc3688a2504a69c662",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a4a488915feaad38345cc01b80d52e8200ff5209",
                    "status": "affected",
                    "version": "b3cebfe8c1cadf1817939dcc3688a2504a69c662",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bc4188a2f56e821ea057aca6bf444e138d06c252",
                    "status": "affected",
                    "version": "b3cebfe8c1cadf1817939dcc3688a2504a69c662",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/powerpc/kvm/powerpc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.18"
                  },
                  {
                    "lessThan": "4.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.199",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.136",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.13.*",
                    "status": "unaffected",
                    "version": "5.13.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.14",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A14B3FB8-763B-434E-88A7-97AC33E54F7F",
                    "versionEndExcluding": "4.19.199",
                    "versionStartIncluding": "4.18",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E1FCD98C-8886-4844-B7AF-C42731DF9465",
                    "versionEndExcluding": "5.4.136",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1BD5A2EE-859F-40FC-BDAC-167AAE37C870",
                    "versionEndExcluding": "5.10.54",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "512C22FC-1524-4E6F-9E62-4F4B7B6E0576",
                    "versionEndExcluding": "5.13.6",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.14:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "71268287-21A8-4488-AA4F-23C473153131",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.14:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "23B9E5C6-FAB5-4A02-9E39-27C8787B0991",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak\n\nvcpu_put is not called if the user copy fails. This can result in preempt\nnotifier corruption and crashes, among other issues."
          },
          {
            "lang": "es",
            "value": " En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: PPC: correcci\u00f3n de fuga de kvm_arch_vcpu_ioctl vcpu_load. No se llama a vcpu_put si falla la copia del usuario. Esto puede provocar da\u00f1os y bloqueos del notificador preventivo, entre otros problemas."
          }
        ],
        "id": "CVE-2021-47296",
        "lastModified": "2026-08-04T10:16:56.760",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47296",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-28T19:22:38.048038Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-21T15:15:17.477",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9bafc34dc4ad0cef18727c557f21ed3c3304df50"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a4a488915feaad38345cc01b80d52e8200ff5209"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bc4188a2f56e821ea057aca6bf444e138d06c252"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e14ef1095387f764d95614d3ec9e4d07c82a3533"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f38527f1890543cdfca8dfd06f75f9887cce6151"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9bafc34dc4ad0cef18727c557f21ed3c3304df50"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a4a488915feaad38345cc01b80d52e8200ff5209"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bc4188a2f56e821ea057aca6bf444e138d06c252"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e14ef1095387f764d95614d3ec9e4d07c82a3533"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f38527f1890543cdfca8dfd06f75f9887cce6151"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-401"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:03:30+00:00",
      "cve": "CVE-2021-47296",
      "id": "CVE-2021-47296",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47296.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-05T17:10:30Z",
      "cve": "CVE-2021-47296",
      "id": "CVE-2021-47296",
      "initial_release_date": "2024-05-23T03:04:57Z",
      "product_status:known_affected": "388",
      "product_status:known_not_affected": "314",
      "product_status:recommended": "135",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47296",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47296.json",
      "version": "45"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:32:08.371Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/9bafc34dc4ad0cef18727c557f21ed3c3304df50"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/f38527f1890543cdfca8dfd06f75f9887cce6151"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/e14ef1095387f764d95614d3ec9e4d07c82a3533"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/a4a488915feaad38345cc01b80d52e8200ff5209"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/bc4188a2f56e821ea057aca6bf444e138d06c252"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47296",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-05-28T19:22:38.048038Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-28T19:22:47.399Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "arch/powerpc/kvm/powerpc.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "9bafc34dc4ad0cef18727c557f21ed3c3304df50",
                  "status": "affected",
                  "version": "b3cebfe8c1cadf1817939dcc3688a2504a69c662",
                  "versionType": "git"
                },
                {
                  "lessThan": "f38527f1890543cdfca8dfd06f75f9887cce6151",
                  "status": "affected",
                  "version": "b3cebfe8c1cadf1817939dcc3688a2504a69c662",
                  "versionType": "git"
                },
                {
                  "lessThan": "e14ef1095387f764d95614d3ec9e4d07c82a3533",
                  "status": "affected",
                  "version": "b3cebfe8c1cadf1817939dcc3688a2504a69c662",
                  "versionType": "git"
                },
                {
                  "lessThan": "a4a488915feaad38345cc01b80d52e8200ff5209",
                  "status": "affected",
                  "version": "b3cebfe8c1cadf1817939dcc3688a2504a69c662",
                  "versionType": "git"
                },
                {
                  "lessThan": "bc4188a2f56e821ea057aca6bf444e138d06c252",
                  "status": "affected",
                  "version": "b3cebfe8c1cadf1817939dcc3688a2504a69c662",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "arch/powerpc/kvm/powerpc.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.18"
                },
                {
                  "lessThan": "4.18",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.199",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.136",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.54",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.13.*",
                  "status": "unaffected",
                  "version": "5.13.6",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.14",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.199",
                      "versionStartIncluding": "4.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.136",
                      "versionStartIncluding": "4.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.54",
                      "versionStartIncluding": "4.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.13.6",
                      "versionStartIncluding": "4.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.14",
                      "versionStartIncluding": "4.18",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak\n\nvcpu_put is not called if the user copy fails. This can result in preempt\nnotifier corruption and crashes, among other issues."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - Triggered via local host ioctls on a KVM vCPU fd (/dev/kvm \u2192 KVM_CREATE_VM \u2192 KVM_CREATE_VCPU \u2192 KVM_ENABLE_CAP/KVM_DIRTY_TLB), not via network packets or unaided guest execution.\nAC:L - The attacker reliably forces the bug by passing an invalid userspace pointer so copy_from_user fails after vcpu_load; no race or attacker-independent condition is required.\nPR:L - The ioctl path has no capable() check; access needs only /dev/kvm permissions (kvm group or equivalent device access), which is unprivileged rather than init-namespace root.\nUI:N - The attacker triggers the leak directly with their own KVM ioctls; no separate victim action is required.\nS:U - This is host userspace (VMM) corrupting host kernel state via the KVM ioctl interface, not a guest-to-host escape across a VM security boundary.\nC:H - Leaked preempt_notifier remains linked after vcpu free (kvm_destroy_vcpus), yielding a use-after-free of the vcpu object whose sprayed contents can disclose kernel memory when sched_in/out runs.\nI:H - UAF of the embedded preempt_notifier (including the ops pointer) and double-register hlist corruption enable heap corruption and control-flow hijack when notifier callbacks fire.\nA:H - Double preempt_notifier_register creates a self-referential hlist that infinite-loops in the scheduler, and the UAF/corruption paths cause kernel oops, hang, or panic."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:47:08.193Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/9bafc34dc4ad0cef18727c557f21ed3c3304df50"
            },
            {
              "url": "https://git.kernel.org/stable/c/f38527f1890543cdfca8dfd06f75f9887cce6151"
            },
            {
              "url": "https://git.kernel.org/stable/c/e14ef1095387f764d95614d3ec9e4d07c82a3533"
            },
            {
              "url": "https://git.kernel.org/stable/c/a4a488915feaad38345cc01b80d52e8200ff5209"
            },
            {
              "url": "https://git.kernel.org/stable/c/bc4188a2f56e821ea057aca6bf444e138d06c252"
            }
          ],
          "title": "KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47296",
        "datePublished": "2024-05-21T14:35:19.341Z",
        "dateReserved": "2024-05-21T13:27:52.130Z",
        "dateUpdated": "2026-08-05T08:47:08.193Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.