GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47341 (GCVE-0-2021-47341)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:35 – Updated: 2026-08-05 08:47
VLAI
Title
KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio BUG: KASAN: use-after-free in kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:183 Read of size 8 at addr ffff0000c03a2500 by task syz-executor083/4269 CPU: 5 PID: 4269 Comm: syz-executor083 Not tainted 5.10.0 #7 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x2d0 arch/arm64/kernel/stacktrace.c:132 show_stack+0x28/0x34 arch/arm64/kernel/stacktrace.c:196 __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x110/0x164 lib/dump_stack.c:118 print_address_description+0x78/0x5c8 mm/kasan/report.c:385 __kasan_report mm/kasan/report.c:545 [inline] kasan_report+0x148/0x1e4 mm/kasan/report.c:562 check_memory_region_inline mm/kasan/generic.c:183 [inline] __asan_load8+0xb4/0xbc mm/kasan/generic.c:252 kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:183 kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline] invoke_syscall arch/arm64/kernel/syscall.c:48 [inline] el0_svc_common arch/arm64/kernel/syscall.c:158 [inline] do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220 el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367 el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383 el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670 Allocated by task 4269: stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121 kasan_save_stack mm/kasan/common.c:48 [inline] kasan_set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc+0xdc/0x120 mm/kasan/common.c:461 kasan_kmalloc+0xc/0x14 mm/kasan/common.c:475 kmem_cache_alloc_trace include/linux/slab.h:450 [inline] kmalloc include/linux/slab.h:552 [inline] kzalloc include/linux/slab.h:664 [inline] kvm_vm_ioctl_register_coalesced_mmio+0x78/0x1cc arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:146 kvm_vm_ioctl+0x7e8/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3746 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline] invoke_syscall arch/arm64/kernel/syscall.c:48 [inline] el0_svc_common arch/arm64/kernel/syscall.c:158 [inline] do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220 el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367 el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383 el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670 Freed by task 4269: stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121 kasan_save_stack mm/kasan/common.c:48 [inline] kasan_set_track+0x38/0x6c mm/kasan/common.c:56 kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:355 __kasan_slab_free+0x124/0x150 mm/kasan/common.c:422 kasan_slab_free+0x10/0x1c mm/kasan/common.c:431 slab_free_hook mm/slub.c:1544 [inline] slab_free_freelist_hook mm/slub.c:1577 [inline] slab_free mm/slub.c:3142 [inline] kfree+0x104/0x38c mm/slub.c:4124 coalesced_mmio_destructor+0x94/0xa4 arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:102 kvm_iodevice_destructor include/kvm/iodev.h:61 [inline] kvm_io_bus_unregister_dev+0x248/0x280 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:4374 kvm_vm_ioctl_unregister_coalesced_mmio+0x158/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:186 kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline] invoke_syscall arch/arm64/kernel/sys ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:38 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7d1bc32d6477ff96a32695ea4be8144e4513ab2d , < f2ff9d03432fcb160e9f7d4be26174d89de2779a (git)
Affected: 2a20592baff59c5351c5200ec667e1a2aa22af85 , < 679837dc0abaa2c6e2a7bcd86483e05eee1d5066 (git)
Affected: 50cbad42bfea8c052b7ca590bd4126cdc898713c , < 8d7c539316d652d217e5e82b89ee204c812a7061 (git)
Affected: 5d3c4c79384af06e3c8e25b7770b6247496b4417 , < 069d44a24c0ff8f85adf49233aae7a8ca16f5c7e (git)
Affected: 5d3c4c79384af06e3c8e25b7770b6247496b4417 , < 23fa2e46a5556f787ce2ea1a315d3ab93cced204 (git)
Affected: 168e82f640ed1891a700bdb43e37da354b2ab63c (git)
Affected: 5.4.119 , < 5.4.134 (semver)
Affected: 5.10.37 , < 5.10.52 (semver)
Affected: 5.12.4 , < 5.12.19 (semver)
Affected: 5.11.21 , < 5.12 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 5.4.134 , ≤ 5.4.* (semver)
Unaffected: 5.10.52 , ≤ 5.10.* (semver)
Unaffected: 5.12.19 , ≤ 5.12.* (semver)
Unaffected: 5.13.4 , ≤ 5.13.* (semver)
Unaffected: 5.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.601Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f2ff9d03432fcb160e9f7d4be26174d89de2779a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/679837dc0abaa2c6e2a7bcd86483e05eee1d5066"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8d7c539316d652d217e5e82b89ee204c812a7061"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/069d44a24c0ff8f85adf49233aae7a8ca16f5c7e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/23fa2e46a5556f787ce2ea1a315d3ab93cced204"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47341",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:38:50.302115Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:49.116Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "virt/kvm/coalesced_mmio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f2ff9d03432fcb160e9f7d4be26174d89de2779a",
              "status": "affected",
              "version": "7d1bc32d6477ff96a32695ea4be8144e4513ab2d",
              "versionType": "git"
            },
            {
              "lessThan": "679837dc0abaa2c6e2a7bcd86483e05eee1d5066",
              "status": "affected",
              "version": "2a20592baff59c5351c5200ec667e1a2aa22af85",
              "versionType": "git"
            },
            {
              "lessThan": "8d7c539316d652d217e5e82b89ee204c812a7061",
              "status": "affected",
              "version": "50cbad42bfea8c052b7ca590bd4126cdc898713c",
              "versionType": "git"
            },
            {
              "lessThan": "069d44a24c0ff8f85adf49233aae7a8ca16f5c7e",
              "status": "affected",
              "version": "5d3c4c79384af06e3c8e25b7770b6247496b4417",
              "versionType": "git"
            },
            {
              "lessThan": "23fa2e46a5556f787ce2ea1a315d3ab93cced204",
              "status": "affected",
              "version": "5d3c4c79384af06e3c8e25b7770b6247496b4417",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "168e82f640ed1891a700bdb43e37da354b2ab63c",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.134",
              "status": "affected",
              "version": "5.4.119",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.52",
              "status": "affected",
              "version": "5.10.37",
              "versionType": "semver"
            },
            {
              "lessThan": "5.12.19",
              "status": "affected",
              "version": "5.12.4",
              "versionType": "semver"
            },
            {
              "lessThan": "5.12",
              "status": "affected",
              "version": "5.11.21",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "virt/kvm/coalesced_mmio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.13.*",
              "status": "unaffected",
              "version": "5.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.134",
                  "versionStartIncluding": "5.4.119",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.52",
                  "versionStartIncluding": "5.10.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.19",
                  "versionStartIncluding": "5.12.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13.4",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.11.21",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio\n\nBUG: KASAN: use-after-free in kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:183\nRead of size 8 at addr ffff0000c03a2500 by task syz-executor083/4269\n\nCPU: 5 PID: 4269 Comm: syz-executor083 Not tainted 5.10.0 #7\nHardware name: linux,dummy-virt (DT)\nCall trace:\n dump_backtrace+0x0/0x2d0 arch/arm64/kernel/stacktrace.c:132\n show_stack+0x28/0x34 arch/arm64/kernel/stacktrace.c:196\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x110/0x164 lib/dump_stack.c:118\n print_address_description+0x78/0x5c8 mm/kasan/report.c:385\n __kasan_report mm/kasan/report.c:545 [inline]\n kasan_report+0x148/0x1e4 mm/kasan/report.c:562\n check_memory_region_inline mm/kasan/generic.c:183 [inline]\n __asan_load8+0xb4/0xbc mm/kasan/generic.c:252\n kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:183\n kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755\n vfs_ioctl fs/ioctl.c:48 [inline]\n __do_sys_ioctl fs/ioctl.c:753 [inline]\n __se_sys_ioctl fs/ioctl.c:739 [inline]\n __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739\n __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]\n invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]\n el0_svc_common arch/arm64/kernel/syscall.c:158 [inline]\n do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220\n el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367\n el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383\n el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670\n\nAllocated by task 4269:\n stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121\n kasan_save_stack mm/kasan/common.c:48 [inline]\n kasan_set_track mm/kasan/common.c:56 [inline]\n __kasan_kmalloc+0xdc/0x120 mm/kasan/common.c:461\n kasan_kmalloc+0xc/0x14 mm/kasan/common.c:475\n kmem_cache_alloc_trace include/linux/slab.h:450 [inline]\n kmalloc include/linux/slab.h:552 [inline]\n kzalloc include/linux/slab.h:664 [inline]\n kvm_vm_ioctl_register_coalesced_mmio+0x78/0x1cc arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:146\n kvm_vm_ioctl+0x7e8/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3746\n vfs_ioctl fs/ioctl.c:48 [inline]\n __do_sys_ioctl fs/ioctl.c:753 [inline]\n __se_sys_ioctl fs/ioctl.c:739 [inline]\n __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739\n __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]\n invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]\n el0_svc_common arch/arm64/kernel/syscall.c:158 [inline]\n do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220\n el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367\n el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383\n el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670\n\nFreed by task 4269:\n stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121\n kasan_save_stack mm/kasan/common.c:48 [inline]\n kasan_set_track+0x38/0x6c mm/kasan/common.c:56\n kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:355\n __kasan_slab_free+0x124/0x150 mm/kasan/common.c:422\n kasan_slab_free+0x10/0x1c mm/kasan/common.c:431\n slab_free_hook mm/slub.c:1544 [inline]\n slab_free_freelist_hook mm/slub.c:1577 [inline]\n slab_free mm/slub.c:3142 [inline]\n kfree+0x104/0x38c mm/slub.c:4124\n coalesced_mmio_destructor+0x94/0xa4 arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:102\n kvm_iodevice_destructor include/kvm/iodev.h:61 [inline]\n kvm_io_bus_unregister_dev+0x248/0x280 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:4374\n kvm_vm_ioctl_unregister_coalesced_mmio+0x158/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:186\n kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755\n vfs_ioctl fs/ioctl.c:48 [inline]\n __do_sys_ioctl fs/ioctl.c:753 [inline]\n __se_sys_ioctl fs/ioctl.c:739 [inline]\n __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739\n __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]\n invoke_syscall arch/arm64/kernel/sys\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachable only via local host ioctls on /dev/kvm (KVM_CREATE_VM then KVM_REGISTER/UNREGISTER_COALESCED_MMIO through kvm_vm_ioctl); not via network packets or unaided guest MMIO.\nAC:L - The attacker fully controls zone registration/unregistration and can reliably force the GFP_KERNEL_ACCOUNT kmalloc failure in kvm_io_bus_unregister_dev (e.g. memcg/memory pressure) that triggers the UAF path.\nPR:L - The ioctl path has no capable() check; access needs only /dev/kvm permissions (kvm group or seat uaccess), which is unprivileged device access rather than init-namespace root.\nUI:N - The attacker triggers the bug directly with their own KVM ioctls; no separate victim action is required.\nS:U - This is host userspace (VMM) corrupting host kernel state via the KVM ioctl interface, not a guest-to-host escape across a VM security boundary.\nC:H - KASAN-confirmed use-after-free of kvm_coalesced_mmio_dev heap objects; freed objects can be reallocated/sprayed to obtain arbitrary kernel memory disclosure.\nI:H - UAF/double-free of IO-bus device objects enables heap corruption and write primitives that can hijack kernel control flow.\nA:H - Dereferencing freed coalesced-MMIO list/device objects causes kernel oops/panic, and UAF paths remain crashable even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:47:18.943Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f2ff9d03432fcb160e9f7d4be26174d89de2779a"
        },
        {
          "url": "https://git.kernel.org/stable/c/679837dc0abaa2c6e2a7bcd86483e05eee1d5066"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d7c539316d652d217e5e82b89ee204c812a7061"
        },
        {
          "url": "https://git.kernel.org/stable/c/069d44a24c0ff8f85adf49233aae7a8ca16f5c7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/23fa2e46a5556f787ce2ea1a315d3ab93cced204"
        }
      ],
      "title": "KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47341",
    "datePublished": "2024-05-21T14:35:49.001Z",
    "dateReserved": "2024-05-21T14:28:16.979Z",
    "dateUpdated": "2026-08-05T08:47:18.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47341",
      "date": "2026-09-16",
      "epss": "0.00252",
      "percentile": "0.16893"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio\\n\\nBUG: KASAN: use-after-free in kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:183\\nRead of size 8 at addr ffff0000c03a2500 by task syz-executor083/4269\\n\\nCPU: 5 PID: 4269 Comm: syz-executor083 Not tainted 5.10.0 #7\\nHardware name: linux,dummy-virt (DT)\\nCall trace:\\n dump_backtrace+0x0/0x2d0 arch/arm64/kernel/stacktrace.c:132\\n show_stack+0x28/0x34 arch/arm64/kernel/stacktrace.c:196\\n __dump_stack lib/dump_stack.c:77 [inline]\\n dump_stack+0x110/0x164 lib/dump_stack.c:118\\n print_address_description+0x78/0x5c8 mm/kasan/report.c:385\\n __kasan_report mm/kasan/report.c:545 [inline]\\n kasan_report+0x148/0x1e4 mm/kasan/report.c:562\\n check_memory_region_inline mm/kasan/generic.c:183 [inline]\\n __asan_load8+0xb4/0xbc mm/kasan/generic.c:252\\n kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:183\\n kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755\\n vfs_ioctl fs/ioctl.c:48 [inline]\\n __do_sys_ioctl fs/ioctl.c:753 [inline]\\n __se_sys_ioctl fs/ioctl.c:739 [inline]\\n __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739\\n __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]\\n invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]\\n el0_svc_common arch/arm64/kernel/syscall.c:158 [inline]\\n do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220\\n el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367\\n el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383\\n el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670\\n\\nAllocated by task 4269:\\n stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121\\n kasan_save_stack mm/kasan/common.c:48 [inline]\\n kasan_set_track mm/kasan/common.c:56 [inline]\\n __kasan_kmalloc+0xdc/0x120 mm/kasan/common.c:461\\n kasan_kmalloc+0xc/0x14 mm/kasan/common.c:475\\n kmem_cache_alloc_trace include/linux/slab.h:450 [inline]\\n kmalloc include/linux/slab.h:552 [inline]\\n kzalloc include/linux/slab.h:664 [inline]\\n kvm_vm_ioctl_register_coalesced_mmio+0x78/0x1cc arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:146\\n kvm_vm_ioctl+0x7e8/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3746\\n vfs_ioctl fs/ioctl.c:48 [inline]\\n __do_sys_ioctl fs/ioctl.c:753 [inline]\\n __se_sys_ioctl fs/ioctl.c:739 [inline]\\n __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739\\n __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]\\n invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]\\n el0_svc_common arch/arm64/kernel/syscall.c:158 [inline]\\n do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220\\n el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367\\n el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383\\n el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670\\n\\nFreed by task 4269:\\n stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121\\n kasan_save_stack mm/kasan/common.c:48 [inline]\\n kasan_set_track+0x38/0x6c mm/kasan/common.c:56\\n kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:355\\n __kasan_slab_free+0x124/0x150 mm/kasan/common.c:422\\n kasan_slab_free+0x10/0x1c mm/kasan/common.c:431\\n slab_free_hook mm/slub.c:1544 [inline]\\n slab_free_freelist_hook mm/slub.c:1577 [inline]\\n slab_free mm/slub.c:3142 [inline]\\n kfree+0x104/0x38c mm/slub.c:4124\\n coalesced_mmio_destructor+0x94/0xa4 arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:102\\n kvm_iodevice_destructor include/kvm/iodev.h:61 [inline]\\n kvm_io_bus_unregister_dev+0x248/0x280 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:4374\\n kvm_vm_ioctl_unregister_coalesced_mmio+0x158/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:186\\n kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755\\n vfs_ioctl fs/ioctl.c:48 [inline]\\n __do_sys_ioctl fs/ioctl.c:753 [inline]\\n __se_sys_ioctl fs/ioctl.c:739 [inline]\\n __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739\\n __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]\\n invoke_syscall arch/arm64/kernel/sys\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: KVM: mmio: Arreglar use-after-free Leer en kvm_vm_ioctl_unregister_coalesced_mmio BUG: KASAN: use-after-free en kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../. ./../virt/kvm/coalesced_mmio.c:183 Lectura de tama\\u00f1o 8 en la direcci\\u00f3n ffff0000c03a2500 por tarea syz-executor083/4269 CPU: 5 PID: 4269 Comm: syz-executor083 Not tainted 5.10.0 #7 Nombre de hardware: linux ,dummy-virt (DT) Seguimiento de llamadas: dump_backtrace+0x0/0x2d0 arch/arm64/kernel/stacktrace.c:132 show_stack+0x28/0x34 arch/arm64/kernel/stacktrace.c:196 __dump_stack lib/dump_stack.c:77 [en l\\u00ednea] dump_stack+0x110/0x164 lib/dump_stack.c:118 print_address_description+0x78/0x5c8 mm/kasan/report.c:385 __kasan_report mm/kasan/report.c:545 [en l\\u00ednea] kasan_report+0x148/0x1e4 mm/kasan /report.c:562 check_memory_region_inline mm/kasan/generic.c:183 [en l\\u00ednea] __asan_load8+0xb4/0xbc mm/kasan/generic.c:252 kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../../ ../virt/kvm/coalesced_mmio.c:183 kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755 vfs_ioctl fs/ioctl.c:48 [ en l\\u00ednea] __do_sys_ioctl fs/ioctl.c:753 [en l\\u00ednea] __se_sys_ioctl fs/ioctl.c:739 [en l\\u00ednea] __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739 __invoke_syscall arch/arm64/kernel/syscall.c:36 [en l\\u00ednea ] invoke_syscall arch/arm64/kernel/syscall.c:48 [en l\\u00ednea] el0_svc_common arch/arm64/kernel/syscall.c:158 [en l\\u00ednea] do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220 el0_svc+0x1c /0x28 arch/arm64/kernel/entry-common.c:367 el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383 el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670 Asignado por tarea 4269: stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121 kasan_save_stack mm/kasan/common.c:48 [en l\\u00ednea] kasan_set_track mm/kasan/common.c:56 [en l\\u00ednea] __kasan_kmalloc+0xdc/0x120 mm/kasan /common.c:461 kasan_kmalloc+0xc/0x14 mm/kasan/common.c:475 kmem_cache_alloc_trace include/linux/slab.h:450 [en l\\u00ednea] kmalloc include/linux/slab.h:552 [en l\\u00ednea] kzalloc include/linux /slab.h:664 [en l\\u00ednea] kvm_vm_ioctl_register_coalesced_mmio+0x78/0x1cc arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:146 kvm_vm_ioctl+0x7e8/0x14c4 arch/arm64/kvm/. ./../../virt/kvm/kvm_main.c:3746 vfs_ioctl fs/ioctl.c:48 [en l\\u00ednea] __do_sys_ioctl fs/ioctl.c:753 [en l\\u00ednea] __se_sys_ioctl fs/ioctl.c:739 [en l\\u00ednea] __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739 __invoke_syscall arch/arm64/kernel/syscall.c:36 [en l\\u00ednea] invoke_syscall arch/arm64/kernel/syscall.c:48 [en l\\u00ednea] el0_svc_common arch/arm64/kernel/syscall .c:158 [en l\\u00ednea] do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220 el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367 el0_sync_handler+0x98/0x170 arch/arm64/ kernel/entry-common.c:383 el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670 Liberado por la tarea 4269: stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121 kasan_save_stack mm/kasan/common.c :48 [en l\\u00ednea] kasan_set_track+0x38/0x6c mm/kasan/common.c:56 kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:355 __kasan_slab_free+0x124/0x150 mm/kasan/common.c:422 kasan_slab_free+0x10 /0x1c mm/kasan/common.c:431 slab_free_hook mm/slub.c:1544 [en l\\u00ednea] slab_free_freelist_hook mm/slub.c:1577 [en l\\u00ednea] slab_free mm/slub.c:3142 [en l\\u00ednea] kfree+0x104/0x38c mm /slub.c:4124 coalesced_mmio_destructor+0x94/0xa4 arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:102 kvm_iodevice_destructor include/kvm/iodev.h:61 [en l\\u00ednea] kvm_io_bus_unregister_dev+ 0x248/0x280 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:4374 kvm_vm_ioctl_unregister_coalesced_mmio+0x158/0x1ec arch/arm64/kvm/../../../virt/kvm /coalesced_mmio.c:186 kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755 vfs_ioctl fs/ioctl.c:48 [en l\\u00ednea] __do_sys_ioctl fs/ioctl .c:753 [en l\\u00ednea] __se_sys_ioctl fs/ioctl.c:739 ---truncado---\"}]",
      "id": "CVE-2021-47341",
      "lastModified": "2024-11-21T06:35:55.343",
      "published": "2024-05-21T15:15:20.850",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/069d44a24c0ff8f85adf49233aae7a8ca16f5c7e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/23fa2e46a5556f787ce2ea1a315d3ab93cced204\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/679837dc0abaa2c6e2a7bcd86483e05eee1d5066\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/8d7c539316d652d217e5e82b89ee204c812a7061\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f2ff9d03432fcb160e9f7d4be26174d89de2779a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/069d44a24c0ff8f85adf49233aae7a8ca16f5c7e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/23fa2e46a5556f787ce2ea1a315d3ab93cced204\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/679837dc0abaa2c6e2a7bcd86483e05eee1d5066\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/8d7c539316d652d217e5e82b89ee204c812a7061\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f2ff9d03432fcb160e9f7d4be26174d89de2779a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Undergoing Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47341\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T15:15:20.850\",\"lastModified\":\"2026-08-04T10:16:58.480\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio\\n\\nBUG: KASAN: use-after-free in kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:183\\nRead of size 8 at addr ffff0000c03a2500 by task syz-executor083/4269\\n\\nCPU: 5 PID: 4269 Comm: syz-executor083 Not tainted 5.10.0 #7\\nHardware name: linux,dummy-virt (DT)\\nCall trace:\\n dump_backtrace+0x0/0x2d0 arch/arm64/kernel/stacktrace.c:132\\n show_stack+0x28/0x34 arch/arm64/kernel/stacktrace.c:196\\n __dump_stack lib/dump_stack.c:77 [inline]\\n dump_stack+0x110/0x164 lib/dump_stack.c:118\\n print_address_description+0x78/0x5c8 mm/kasan/report.c:385\\n __kasan_report mm/kasan/report.c:545 [inline]\\n kasan_report+0x148/0x1e4 mm/kasan/report.c:562\\n check_memory_region_inline mm/kasan/generic.c:183 [inline]\\n __asan_load8+0xb4/0xbc mm/kasan/generic.c:252\\n kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:183\\n kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755\\n vfs_ioctl fs/ioctl.c:48 [inline]\\n __do_sys_ioctl fs/ioctl.c:753 [inline]\\n __se_sys_ioctl fs/ioctl.c:739 [inline]\\n __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739\\n __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]\\n invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]\\n el0_svc_common arch/arm64/kernel/syscall.c:158 [inline]\\n do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220\\n el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367\\n el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383\\n el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670\\n\\nAllocated by task 4269:\\n stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121\\n kasan_save_stack mm/kasan/common.c:48 [inline]\\n kasan_set_track mm/kasan/common.c:56 [inline]\\n __kasan_kmalloc+0xdc/0x120 mm/kasan/common.c:461\\n kasan_kmalloc+0xc/0x14 mm/kasan/common.c:475\\n kmem_cache_alloc_trace include/linux/slab.h:450 [inline]\\n kmalloc include/linux/slab.h:552 [inline]\\n kzalloc include/linux/slab.h:664 [inline]\\n kvm_vm_ioctl_register_coalesced_mmio+0x78/0x1cc arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:146\\n kvm_vm_ioctl+0x7e8/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3746\\n vfs_ioctl fs/ioctl.c:48 [inline]\\n __do_sys_ioctl fs/ioctl.c:753 [inline]\\n __se_sys_ioctl fs/ioctl.c:739 [inline]\\n __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739\\n __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]\\n invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]\\n el0_svc_common arch/arm64/kernel/syscall.c:158 [inline]\\n do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220\\n el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367\\n el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383\\n el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670\\n\\nFreed by task 4269:\\n stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121\\n kasan_save_stack mm/kasan/common.c:48 [inline]\\n kasan_set_track+0x38/0x6c mm/kasan/common.c:56\\n kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:355\\n __kasan_slab_free+0x124/0x150 mm/kasan/common.c:422\\n kasan_slab_free+0x10/0x1c mm/kasan/common.c:431\\n slab_free_hook mm/slub.c:1544 [inline]\\n slab_free_freelist_hook mm/slub.c:1577 [inline]\\n slab_free mm/slub.c:3142 [inline]\\n kfree+0x104/0x38c mm/slub.c:4124\\n coalesced_mmio_destructor+0x94/0xa4 arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:102\\n kvm_iodevice_destructor include/kvm/iodev.h:61 [inline]\\n kvm_io_bus_unregister_dev+0x248/0x280 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:4374\\n kvm_vm_ioctl_unregister_coalesced_mmio+0x158/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:186\\n kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755\\n vfs_ioctl fs/ioctl.c:48 [inline]\\n __do_sys_ioctl fs/ioctl.c:753 [inline]\\n __se_sys_ioctl fs/ioctl.c:739 [inline]\\n __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739\\n __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]\\n invoke_syscall arch/arm64/kernel/sys\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: KVM: mmio: Arreglar use-after-free Leer en kvm_vm_ioctl_unregister_coalesced_mmio BUG: KASAN: use-after-free en kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../. ./../virt/kvm/coalesced_mmio.c:183 Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff0000c03a2500 por tarea syz-executor083/4269 CPU: 5 PID: 4269 Comm: syz-executor083 Not tainted 5.10.0 #7 Nombre de hardware: linux ,dummy-virt (DT) Seguimiento de llamadas: dump_backtrace+0x0/0x2d0 arch/arm64/kernel/stacktrace.c:132 show_stack+0x28/0x34 arch/arm64/kernel/stacktrace.c:196 __dump_stack lib/dump_stack.c:77 [en l\u00ednea] dump_stack+0x110/0x164 lib/dump_stack.c:118 print_address_description+0x78/0x5c8 mm/kasan/report.c:385 __kasan_report mm/kasan/report.c:545 [en l\u00ednea] kasan_report+0x148/0x1e4 mm/kasan /report.c:562 check_memory_region_inline mm/kasan/generic.c:183 [en l\u00ednea] __asan_load8+0xb4/0xbc mm/kasan/generic.c:252 kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../../ ../virt/kvm/coalesced_mmio.c:183 kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755 vfs_ioctl fs/ioctl.c:48 [ en l\u00ednea] __do_sys_ioctl fs/ioctl.c:753 [en l\u00ednea] __se_sys_ioctl fs/ioctl.c:739 [en l\u00ednea] __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739 __invoke_syscall arch/arm64/kernel/syscall.c:36 [en l\u00ednea ] invoke_syscall arch/arm64/kernel/syscall.c:48 [en l\u00ednea] el0_svc_common arch/arm64/kernel/syscall.c:158 [en l\u00ednea] do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220 el0_svc+0x1c /0x28 arch/arm64/kernel/entry-common.c:367 el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383 el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670 Asignado por tarea 4269: stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121 kasan_save_stack mm/kasan/common.c:48 [en l\u00ednea] kasan_set_track mm/kasan/common.c:56 [en l\u00ednea] __kasan_kmalloc+0xdc/0x120 mm/kasan /common.c:461 kasan_kmalloc+0xc/0x14 mm/kasan/common.c:475 kmem_cache_alloc_trace include/linux/slab.h:450 [en l\u00ednea] kmalloc include/linux/slab.h:552 [en l\u00ednea] kzalloc include/linux /slab.h:664 [en l\u00ednea] kvm_vm_ioctl_register_coalesced_mmio+0x78/0x1cc arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:146 kvm_vm_ioctl+0x7e8/0x14c4 arch/arm64/kvm/. ./../../virt/kvm/kvm_main.c:3746 vfs_ioctl fs/ioctl.c:48 [en l\u00ednea] __do_sys_ioctl fs/ioctl.c:753 [en l\u00ednea] __se_sys_ioctl fs/ioctl.c:739 [en l\u00ednea] __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739 __invoke_syscall arch/arm64/kernel/syscall.c:36 [en l\u00ednea] invoke_syscall arch/arm64/kernel/syscall.c:48 [en l\u00ednea] el0_svc_common arch/arm64/kernel/syscall .c:158 [en l\u00ednea] do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220 el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367 el0_sync_handler+0x98/0x170 arch/arm64/ kernel/entry-common.c:383 el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670 Liberado por la tarea 4269: stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121 kasan_save_stack mm/kasan/common.c :48 [en l\u00ednea] kasan_set_track+0x38/0x6c mm/kasan/common.c:56 kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:355 __kasan_slab_free+0x124/0x150 mm/kasan/common.c:422 kasan_slab_free+0x10 /0x1c mm/kasan/common.c:431 slab_free_hook mm/slub.c:1544 [en l\u00ednea] slab_free_freelist_hook mm/slub.c:1577 [en l\u00ednea] slab_free mm/slub.c:3142 [en l\u00ednea] kfree+0x104/0x38c mm /slub.c:4124 coalesced_mmio_destructor+0x94/0xa4 arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:102 kvm_iodevice_destructor include/kvm/iodev.h:61 [en l\u00ednea] kvm_io_bus_unregister_dev+ 0x248/0x280 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:4374 kvm_vm_ioctl_unregister_coalesced_mmio+0x158/0x1ec arch/arm64/kvm/../../../virt/kvm /coalesced_mmio.c:186 kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755 vfs_ioctl fs/ioctl.c:48 [en l\u00ednea] __do_sys_ioctl fs/ioctl .c:753 [en l\u00ednea] __se_sys_ioctl fs/ioctl.c:739 ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"virt/kvm/coalesced_mmio.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7d1bc32d6477ff96a32695ea4be8144e4513ab2d\",\"lessThan\":\"f2ff9d03432fcb160e9f7d4be26174d89de2779a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2a20592baff59c5351c5200ec667e1a2aa22af85\",\"lessThan\":\"679837dc0abaa2c6e2a7bcd86483e05eee1d5066\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"50cbad42bfea8c052b7ca590bd4126cdc898713c\",\"lessThan\":\"8d7c539316d652d217e5e82b89ee204c812a7061\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5d3c4c79384af06e3c8e25b7770b6247496b4417\",\"lessThan\":\"069d44a24c0ff8f85adf49233aae7a8ca16f5c7e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5d3c4c79384af06e3c8e25b7770b6247496b4417\",\"lessThan\":\"23fa2e46a5556f787ce2ea1a315d3ab93cced204\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"168e82f640ed1891a700bdb43e37da354b2ab63c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.4.119\",\"lessThan\":\"5.4.134\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.37\",\"lessThan\":\"5.10.52\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.12.4\",\"lessThan\":\"5.12.19\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.11.21\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"virt/kvm/coalesced_mmio.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.134\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.52\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.12.19\",\"lessThanOrEqual\":\"5.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.13.4\",\"lessThanOrEqual\":\"5.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:38:50.302115Z\",\"id\":\"CVE-2021-47341\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.119\",\"versionEndExcluding\":\"5.4.134\",\"matchCriteriaId\":\"41D74A70-26C8-4D11-B4AF-3B88979BBD13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.37\",\"versionEndExcluding\":\"5.10.52\",\"matchCriteriaId\":\"F3FEC961-161A-4B3B-B796-792BFC605F48\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11.21\",\"versionEndExcluding\":\"5.12\",\"matchCriteriaId\":\"5D4778B3-2521-408B-900C-9048E76A0D8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.12.4\",\"versionEndExcluding\":\"5.12.19\",\"matchCriteriaId\":\"7C328D6C-1E12-493E-BECF-66BFBE7FBA73\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.13\",\"versionEndExcluding\":\"5.13.4\",\"matchCriteriaId\":\"F93FA3CC-0C79-410B-A7D7-245C2AA0723A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"71268287-21A8-4488-AA4F-23C473153131\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/069d44a24c0ff8f85adf49233aae7a8ca16f5c7e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/23fa2e46a5556f787ce2ea1a315d3ab93cced204\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/679837dc0abaa2c6e2a7bcd86483e05eee1d5066\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8d7c539316d652d217e5e82b89ee204c812a7061\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f2ff9d03432fcb160e9f7d4be26174d89de2779a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/069d44a24c0ff8f85adf49233aae7a8ca16f5c7e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/23fa2e46a5556f787ce2ea1a315d3ab93cced204\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/679837dc0abaa2c6e2a7bcd86483e05eee1d5066\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8d7c539316d652d217e5e82b89ee204c812a7061\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f2ff9d03432fcb160e9f7d4be26174d89de2779a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:57:54+00:00",
      "cve": "CVE-2021-47341",
      "id": "CVE-2021-47341",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47341.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:28:55Z",
      "cve": "CVE-2021-47341",
      "id": "CVE-2021-47341",
      "initial_release_date": "2024-05-23T03:04:36Z",
      "product_status:known_affected": "494",
      "product_status:known_not_affected": "187",
      "product_status:recommended": "233",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47341",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47341.json",
      "version": "58"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f2ff9d03432fcb160e9f7d4be26174d89de2779a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/679837dc0abaa2c6e2a7bcd86483e05eee1d5066\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8d7c539316d652d217e5e82b89ee204c812a7061\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/069d44a24c0ff8f85adf49233aae7a8ca16f5c7e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/23fa2e46a5556f787ce2ea1a315d3ab93cced204\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:08.601Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47341\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:38:50.302115Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:18.923Z\"}}], \"cna\": {\"title\": \"KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Reachable only via local host ioctls on /dev/kvm (KVM_CREATE_VM then KVM_REGISTER/UNREGISTER_COALESCED_MMIO through kvm_vm_ioctl); not via network packets or unaided guest MMIO.\\nAC:L - The attacker fully controls zone registration/unregistration and can reliably force the GFP_KERNEL_ACCOUNT kmalloc failure in kvm_io_bus_unregister_dev (e.g. memcg/memory pressure) that triggers the UAF path.\\nPR:L - The ioctl path has no capable() check; access needs only /dev/kvm permissions (kvm group or seat uaccess), which is unprivileged device access rather than init-namespace root.\\nUI:N - The attacker triggers the bug directly with their own KVM ioctls; no separate victim action is required.\\nS:U - This is host userspace (VMM) corrupting host kernel state via the KVM ioctl interface, not a guest-to-host escape across a VM security boundary.\\nC:H - KASAN-confirmed use-after-free of kvm_coalesced_mmio_dev heap objects; freed objects can be reallocated/sprayed to obtain arbitrary kernel memory disclosure.\\nI:H - UAF/double-free of IO-bus device objects enables heap corruption and write primitives that can hijack kernel control flow.\\nA:H - Dereferencing freed coalesced-MMIO list/device objects causes kernel oops/panic, and UAF paths remain crashable even without full exploitation.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7d1bc32d6477ff96a32695ea4be8144e4513ab2d\", \"lessThan\": \"f2ff9d03432fcb160e9f7d4be26174d89de2779a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2a20592baff59c5351c5200ec667e1a2aa22af85\", \"lessThan\": \"679837dc0abaa2c6e2a7bcd86483e05eee1d5066\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"50cbad42bfea8c052b7ca590bd4126cdc898713c\", \"lessThan\": \"8d7c539316d652d217e5e82b89ee204c812a7061\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5d3c4c79384af06e3c8e25b7770b6247496b4417\", \"lessThan\": \"069d44a24c0ff8f85adf49233aae7a8ca16f5c7e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5d3c4c79384af06e3c8e25b7770b6247496b4417\", \"lessThan\": \"23fa2e46a5556f787ce2ea1a315d3ab93cced204\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"168e82f640ed1891a700bdb43e37da354b2ab63c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.4.119\", \"lessThan\": \"5.4.134\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.10.37\", \"lessThan\": \"5.10.52\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.12.4\", \"lessThan\": \"5.12.19\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.11.21\", \"lessThan\": \"5.12\", \"versionType\": \"semver\"}], \"programFiles\": [\"virt/kvm/coalesced_mmio.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.134\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.52\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.13.*\"}, {\"status\": \"unaffected\", \"version\": \"5.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"virt/kvm/coalesced_mmio.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f2ff9d03432fcb160e9f7d4be26174d89de2779a\"}, {\"url\": \"https://git.kernel.org/stable/c/679837dc0abaa2c6e2a7bcd86483e05eee1d5066\"}, {\"url\": \"https://git.kernel.org/stable/c/8d7c539316d652d217e5e82b89ee204c812a7061\"}, {\"url\": \"https://git.kernel.org/stable/c/069d44a24c0ff8f85adf49233aae7a8ca16f5c7e\"}, {\"url\": \"https://git.kernel.org/stable/c/23fa2e46a5556f787ce2ea1a315d3ab93cced204\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio\\n\\nBUG: KASAN: use-after-free in kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:183\\nRead of size 8 at addr ffff0000c03a2500 by task syz-executor083/4269\\n\\nCPU: 5 PID: 4269 Comm: syz-executor083 Not tainted 5.10.0 #7\\nHardware name: linux,dummy-virt (DT)\\nCall trace:\\n dump_backtrace+0x0/0x2d0 arch/arm64/kernel/stacktrace.c:132\\n show_stack+0x28/0x34 arch/arm64/kernel/stacktrace.c:196\\n __dump_stack lib/dump_stack.c:77 [inline]\\n dump_stack+0x110/0x164 lib/dump_stack.c:118\\n print_address_description+0x78/0x5c8 mm/kasan/report.c:385\\n __kasan_report mm/kasan/report.c:545 [inline]\\n kasan_report+0x148/0x1e4 mm/kasan/report.c:562\\n check_memory_region_inline mm/kasan/generic.c:183 [inline]\\n __asan_load8+0xb4/0xbc mm/kasan/generic.c:252\\n kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:183\\n kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755\\n vfs_ioctl fs/ioctl.c:48 [inline]\\n __do_sys_ioctl fs/ioctl.c:753 [inline]\\n __se_sys_ioctl fs/ioctl.c:739 [inline]\\n __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739\\n __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]\\n invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]\\n el0_svc_common arch/arm64/kernel/syscall.c:158 [inline]\\n do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220\\n el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367\\n el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383\\n el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670\\n\\nAllocated by task 4269:\\n stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121\\n kasan_save_stack mm/kasan/common.c:48 [inline]\\n kasan_set_track mm/kasan/common.c:56 [inline]\\n __kasan_kmalloc+0xdc/0x120 mm/kasan/common.c:461\\n kasan_kmalloc+0xc/0x14 mm/kasan/common.c:475\\n kmem_cache_alloc_trace include/linux/slab.h:450 [inline]\\n kmalloc include/linux/slab.h:552 [inline]\\n kzalloc include/linux/slab.h:664 [inline]\\n kvm_vm_ioctl_register_coalesced_mmio+0x78/0x1cc arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:146\\n kvm_vm_ioctl+0x7e8/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3746\\n vfs_ioctl fs/ioctl.c:48 [inline]\\n __do_sys_ioctl fs/ioctl.c:753 [inline]\\n __se_sys_ioctl fs/ioctl.c:739 [inline]\\n __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739\\n __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]\\n invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]\\n el0_svc_common arch/arm64/kernel/syscall.c:158 [inline]\\n do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220\\n el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367\\n el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383\\n el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670\\n\\nFreed by task 4269:\\n stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121\\n kasan_save_stack mm/kasan/common.c:48 [inline]\\n kasan_set_track+0x38/0x6c mm/kasan/common.c:56\\n kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:355\\n __kasan_slab_free+0x124/0x150 mm/kasan/common.c:422\\n kasan_slab_free+0x10/0x1c mm/kasan/common.c:431\\n slab_free_hook mm/slub.c:1544 [inline]\\n slab_free_freelist_hook mm/slub.c:1577 [inline]\\n slab_free mm/slub.c:3142 [inline]\\n kfree+0x104/0x38c mm/slub.c:4124\\n coalesced_mmio_destructor+0x94/0xa4 arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:102\\n kvm_iodevice_destructor include/kvm/iodev.h:61 [inline]\\n kvm_io_bus_unregister_dev+0x248/0x280 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:4374\\n kvm_vm_ioctl_unregister_coalesced_mmio+0x158/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:186\\n kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755\\n vfs_ioctl fs/ioctl.c:48 [inline]\\n __do_sys_ioctl fs/ioctl.c:753 [inline]\\n __se_sys_ioctl fs/ioctl.c:739 [inline]\\n __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739\\n __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]\\n invoke_syscall arch/arm64/kernel/sys\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.134\", \"versionStartIncluding\": \"5.4.119\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.52\", \"versionStartIncluding\": \"5.10.37\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.19\", \"versionStartIncluding\": \"5.12.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13.4\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.14\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.11.21\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:47:18.943Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47341\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:47:18.943Z\", \"dateReserved\": \"2024-05-21T14:28:16.979Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T14:35:49.001Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.