GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47505 (GCVE-0-2021-47505)

Vulnerability from cvelistv5 – Published: 2024-05-24 15:01 – Updated: 2026-08-05 08:48
VLAI
Title
aio: fix use-after-free due to missing POLLFREE handling
Summary
In the Linux kernel, the following vulnerability has been resolved: aio: fix use-after-free due to missing POLLFREE handling signalfd_poll() and binder_poll() are special in that they use a waitqueue whose lifetime is the current task, rather than the struct file as is normally the case. This is okay for blocking polls, since a blocking poll occurs within one task; however, non-blocking polls require another solution. This solution is for the queue to be cleared before it is freed, by sending a POLLFREE notification to all waiters. Unfortunately, only eventpoll handles POLLFREE. A second type of non-blocking poll, aio poll, was added in kernel v4.18, and it doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with aio poll, and the waitqueue gets freed. Fix this by making aio poll handle POLLFREE. A patch by Ramji Jiyani <ramjiyani@google.com> (https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com) tried to do this by making aio_poll_wake() always complete the request inline if POLLFREE is seen. However, that solution had two bugs. First, it introduced a deadlock, as it unconditionally locked the aio context while holding the waitqueue lock, which inverts the normal locking order. Second, it didn't consider that POLLFREE notifications are missed while the request has been temporarily de-queued. The second problem was solved by my previous patch. This patch then properly fixes the use-after-free by handling POLLFREE in a deadlock-free way. It does this by taking advantage of the fact that freeing of the waitqueue is RCU-delayed, similar to what eventpoll does.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-14 18:37 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2c14fa838cbefc23cf1c73ca167ed85b274b2913 , < 321fba81ec034f88aea4898993c1bf15605c023f (git)
Affected: 2c14fa838cbefc23cf1c73ca167ed85b274b2913 , < 4105e6a128e8a98455dfc9e6dbb2ab0c33c4497f (git)
Affected: 2c14fa838cbefc23cf1c73ca167ed85b274b2913 , < 47ffefd88abfffe8a040bcc1dd0554d4ea6f7689 (git)
Affected: 2c14fa838cbefc23cf1c73ca167ed85b274b2913 , < 60d311f9e6381d779d7d53371f87285698ecee24 (git)
Affected: 2c14fa838cbefc23cf1c73ca167ed85b274b2913 , < 50252e4b5e989ce64555c7aef7516bdefc2fea72 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.18
Unaffected: 0 , < 4.18 (semver)
Unaffected: 4.19.221 , ≤ 4.19.* (semver)
Unaffected: 5.4.165 , ≤ 5.4.* (semver)
Unaffected: 5.10.85 , ≤ 5.10.* (semver)
Unaffected: 5.15.8 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47505",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-14T18:37:27.922309Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-30T15:15:43.456Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.807Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/321fba81ec034f88aea4898993c1bf15605c023f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4105e6a128e8a98455dfc9e6dbb2ab0c33c4497f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/47ffefd88abfffe8a040bcc1dd0554d4ea6f7689"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/60d311f9e6381d779d7d53371f87285698ecee24"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/50252e4b5e989ce64555c7aef7516bdefc2fea72"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/aio.c",
            "include/uapi/asm-generic/poll.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "321fba81ec034f88aea4898993c1bf15605c023f",
              "status": "affected",
              "version": "2c14fa838cbefc23cf1c73ca167ed85b274b2913",
              "versionType": "git"
            },
            {
              "lessThan": "4105e6a128e8a98455dfc9e6dbb2ab0c33c4497f",
              "status": "affected",
              "version": "2c14fa838cbefc23cf1c73ca167ed85b274b2913",
              "versionType": "git"
            },
            {
              "lessThan": "47ffefd88abfffe8a040bcc1dd0554d4ea6f7689",
              "status": "affected",
              "version": "2c14fa838cbefc23cf1c73ca167ed85b274b2913",
              "versionType": "git"
            },
            {
              "lessThan": "60d311f9e6381d779d7d53371f87285698ecee24",
              "status": "affected",
              "version": "2c14fa838cbefc23cf1c73ca167ed85b274b2913",
              "versionType": "git"
            },
            {
              "lessThan": "50252e4b5e989ce64555c7aef7516bdefc2fea72",
              "status": "affected",
              "version": "2c14fa838cbefc23cf1c73ca167ed85b274b2913",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/aio.c",
            "include/uapi/asm-generic/poll.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.221",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.165",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.85",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.8",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naio: fix use-after-free due to missing POLLFREE handling\n\nsignalfd_poll() and binder_poll() are special in that they use a\nwaitqueue whose lifetime is the current task, rather than the struct\nfile as is normally the case.  This is okay for blocking polls, since a\nblocking poll occurs within one task; however, non-blocking polls\nrequire another solution.  This solution is for the queue to be cleared\nbefore it is freed, by sending a POLLFREE notification to all waiters.\n\nUnfortunately, only eventpoll handles POLLFREE.  A second type of\nnon-blocking poll, aio poll, was added in kernel v4.18, and it doesn\u0027t\nhandle POLLFREE.  This allows a use-after-free to occur if a signalfd or\nbinder fd is polled with aio poll, and the waitqueue gets freed.\n\nFix this by making aio poll handle POLLFREE.\n\nA patch by Ramji Jiyani \u003cramjiyani@google.com\u003e\n(https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com)\ntried to do this by making aio_poll_wake() always complete the request\ninline if POLLFREE is seen.  However, that solution had two bugs.\nFirst, it introduced a deadlock, as it unconditionally locked the aio\ncontext while holding the waitqueue lock, which inverts the normal\nlocking order.  Second, it didn\u0027t consider that POLLFREE notifications\nare missed while the request has been temporarily de-queued.\n\nThe second problem was solved by my previous patch.  This patch then\nproperly fixes the use-after-free by handling POLLFREE in a\ndeadlock-free way.  It does this by taking advantage of the fact that\nfreeing of the waitqueue is RCU-delayed, similar to what eventpoll does."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggered via local syscalls (io_setup/io_submit with IOCB_CMD_POLL on a signalfd or binder fd); not reachable from the network stack or remote protocols.\nAC:L - The attacker fully controls both sides\u2014submitting the aio poll and freeing the waitqueue (e.g. BINDER_THREAD_EXIT, or exiting a task whose sighand owns the queue while the aio context survives via CLONE_VM)\u2014so the UAF is reliably inducible.\nPR:L - io_setup, io_submit, signalfd, and binder ioctls are available to unprivileged users; no CAP_* or root is required along the path.\nUI:N - Exploitation needs no victim action; the attacker performs all setup and teardown themselves.\nS:U - Impact is confined to the local kernel/host authority (standard kernel memory corruption / privilege escalation); it does not cross a VM, IOMMU, or other security boundary.\nC:H - Use-after-free on the waitqueue object enables reclaim and controlled contents, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same UAF is exploitable for heap spray and arbitrary write / control-flow hijacking in the kernel, enabling integrity compromise and code execution.\nA:H - Accessing the freed waitqueue lock or structure causes kernel oops/panic even without a full exploit, so availability impact is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:48:09.163Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/321fba81ec034f88aea4898993c1bf15605c023f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4105e6a128e8a98455dfc9e6dbb2ab0c33c4497f"
        },
        {
          "url": "https://git.kernel.org/stable/c/47ffefd88abfffe8a040bcc1dd0554d4ea6f7689"
        },
        {
          "url": "https://git.kernel.org/stable/c/60d311f9e6381d779d7d53371f87285698ecee24"
        },
        {
          "url": "https://git.kernel.org/stable/c/50252e4b5e989ce64555c7aef7516bdefc2fea72"
        }
      ],
      "title": "aio: fix use-after-free due to missing POLLFREE handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47505",
    "datePublished": "2024-05-24T15:01:52.088Z",
    "dateReserved": "2024-05-22T06:20:56.205Z",
    "dateUpdated": "2026-08-05T08:48:09.163Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47505",
      "date": "2026-09-14",
      "epss": "0.00252",
      "percentile": "0.16769"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.18\", \"versionEndExcluding\": \"4.19.221\", \"matchCriteriaId\": \"2063CE6C-8929-4035-8896-B8ED72601F98\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.20\", \"versionEndExcluding\": \"5.4.165\", \"matchCriteriaId\": \"B1DD3148-41FC-42AC-96A5-F63D774A97A3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.85\", \"matchCriteriaId\": \"D9668578-08F7-4694-A86F-FCE448387A79\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.8\", \"matchCriteriaId\": \"6664ACE2-F748-4AE5-B98B-58803B0B2C3E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"357AA433-37E8-4323-BFB2-3038D6E4B414\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"A73429BA-C2D9-4D0C-A75F-06A1CA8B3983\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"F621B5E3-E99D-49E7-90B9-EC3B77C95383\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.16:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"F7BFDCAA-1650-49AA-8462-407DD593F94F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\naio: fix use-after-free due to missing POLLFREE handling\\n\\nsignalfd_poll() and binder_poll() are special in that they use a\\nwaitqueue whose lifetime is the current task, rather than the struct\\nfile as is normally the case.  This is okay for blocking polls, since a\\nblocking poll occurs within one task; however, non-blocking polls\\nrequire another solution.  This solution is for the queue to be cleared\\nbefore it is freed, by sending a POLLFREE notification to all waiters.\\n\\nUnfortunately, only eventpoll handles POLLFREE.  A second type of\\nnon-blocking poll, aio poll, was added in kernel v4.18, and it doesn\u0027t\\nhandle POLLFREE.  This allows a use-after-free to occur if a signalfd or\\nbinder fd is polled with aio poll, and the waitqueue gets freed.\\n\\nFix this by making aio poll handle POLLFREE.\\n\\nA patch by Ramji Jiyani \u003cramjiyani@google.com\u003e\\n(https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com)\\ntried to do this by making aio_poll_wake() always complete the request\\ninline if POLLFREE is seen.  However, that solution had two bugs.\\nFirst, it introduced a deadlock, as it unconditionally locked the aio\\ncontext while holding the waitqueue lock, which inverts the normal\\nlocking order.  Second, it didn\u0027t consider that POLLFREE notifications\\nare missed while the request has been temporarily de-queued.\\n\\nThe second problem was solved by my previous patch.  This patch then\\nproperly fixes the use-after-free by handling POLLFREE in a\\ndeadlock-free way.  It does this by taking advantage of the fact that\\nfreeing of the waitqueue is RCU-delayed, similar to what eventpoll does.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: aio: corrige el use-after-free debido a la falta de manejo de POLLFREE. signalfd_poll() y binder_poll() son especiales porque usan una cola de espera cuya duraci\\u00f3n es la tarea actual, en lugar de la struct archivo como es normalmente el caso. Esto est\\u00e1 bien para bloquear encuestas, ya que una encuesta de bloqueo ocurre dentro de una tarea; sin embargo, las encuestas sin bloqueo requieren otra soluci\\u00f3n. Esta soluci\\u00f3n consiste en despejar la cola antes de liberarla, enviando una notificaci\\u00f3n POLLFREE a todos los camareros. Desafortunadamente, s\\u00f3lo eventpoll maneja POLLFREE. Un segundo tipo de encuesta sin bloqueo, aio poll, se agreg\\u00f3 en el kernel v4.18 y no maneja POLLFREE. Esto permite que se produzca un use-after-free si se sondea un signalfd o un binder fd con aio poll y se libera la cola de espera. Solucione este problema haciendo que la encuesta de aio se maneje POLLFREE. Un parche de Ramji Jiyani  (https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com) intent\\u00f3 hacer esto haciendo que aio_poll_wake() siempre completara la solicitud en l\\u00ednea si Se ve POLLFREE. Sin embargo, esa soluci\\u00f3n ten\\u00eda dos errores. Primero, introdujo un punto muerto, ya que bloque\\u00f3 incondicionalmente el contexto aio mientras manten\\u00eda el bloqueo de la cola de espera, lo que invierte el orden de bloqueo normal. En segundo lugar, no consider\\u00f3 que las notificaciones de POLLFREE se pierdan mientras la solicitud ha sido retirada temporalmente de la cola. El segundo problema lo resolvi\\u00f3 mi parche anterior. Luego, este parche corrige adecuadamente el use-after-free al manejar POLLFREE sin interbloqueos. Lo hace aprovechando el hecho de que la liberaci\\u00f3n de la cola de espera tiene un retraso de RCU, similar a lo que hace eventpoll.\"}]",
      "id": "CVE-2021-47505",
      "lastModified": "2025-01-10T18:00:30.987",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-05-24T15:15:11.000",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/321fba81ec034f88aea4898993c1bf15605c023f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4105e6a128e8a98455dfc9e6dbb2ab0c33c4497f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/47ffefd88abfffe8a040bcc1dd0554d4ea6f7689\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/50252e4b5e989ce64555c7aef7516bdefc2fea72\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/60d311f9e6381d779d7d53371f87285698ecee24\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/321fba81ec034f88aea4898993c1bf15605c023f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4105e6a128e8a98455dfc9e6dbb2ab0c33c4497f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/47ffefd88abfffe8a040bcc1dd0554d4ea6f7689\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/50252e4b5e989ce64555c7aef7516bdefc2fea72\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/60d311f9e6381d779d7d53371f87285698ecee24\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47505\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-24T15:15:11.000\",\"lastModified\":\"2026-08-04T10:17:06.420\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\naio: fix use-after-free due to missing POLLFREE handling\\n\\nsignalfd_poll() and binder_poll() are special in that they use a\\nwaitqueue whose lifetime is the current task, rather than the struct\\nfile as is normally the case.  This is okay for blocking polls, since a\\nblocking poll occurs within one task; however, non-blocking polls\\nrequire another solution.  This solution is for the queue to be cleared\\nbefore it is freed, by sending a POLLFREE notification to all waiters.\\n\\nUnfortunately, only eventpoll handles POLLFREE.  A second type of\\nnon-blocking poll, aio poll, was added in kernel v4.18, and it doesn\u0027t\\nhandle POLLFREE.  This allows a use-after-free to occur if a signalfd or\\nbinder fd is polled with aio poll, and the waitqueue gets freed.\\n\\nFix this by making aio poll handle POLLFREE.\\n\\nA patch by Ramji Jiyani \u003cramjiyani@google.com\u003e\\n(https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com)\\ntried to do this by making aio_poll_wake() always complete the request\\ninline if POLLFREE is seen.  However, that solution had two bugs.\\nFirst, it introduced a deadlock, as it unconditionally locked the aio\\ncontext while holding the waitqueue lock, which inverts the normal\\nlocking order.  Second, it didn\u0027t consider that POLLFREE notifications\\nare missed while the request has been temporarily de-queued.\\n\\nThe second problem was solved by my previous patch.  This patch then\\nproperly fixes the use-after-free by handling POLLFREE in a\\ndeadlock-free way.  It does this by taking advantage of the fact that\\nfreeing of the waitqueue is RCU-delayed, similar to what eventpoll does.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: aio: corrige el use-after-free debido a la falta de manejo de POLLFREE. signalfd_poll() y binder_poll() son especiales porque usan una cola de espera cuya duraci\u00f3n es la tarea actual, en lugar de la struct archivo como es normalmente el caso. Esto est\u00e1 bien para bloquear encuestas, ya que una encuesta de bloqueo ocurre dentro de una tarea; sin embargo, las encuestas sin bloqueo requieren otra soluci\u00f3n. Esta soluci\u00f3n consiste en despejar la cola antes de liberarla, enviando una notificaci\u00f3n POLLFREE a todos los camareros. Desafortunadamente, s\u00f3lo eventpoll maneja POLLFREE. Un segundo tipo de encuesta sin bloqueo, aio poll, se agreg\u00f3 en el kernel v4.18 y no maneja POLLFREE. Esto permite que se produzca un use-after-free si se sondea un signalfd o un binder fd con aio poll y se libera la cola de espera. Solucione este problema haciendo que la encuesta de aio se maneje POLLFREE. Un parche de Ramji Jiyani  (https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com) intent\u00f3 hacer esto haciendo que aio_poll_wake() siempre completara la solicitud en l\u00ednea si Se ve POLLFREE. Sin embargo, esa soluci\u00f3n ten\u00eda dos errores. Primero, introdujo un punto muerto, ya que bloque\u00f3 incondicionalmente el contexto aio mientras manten\u00eda el bloqueo de la cola de espera, lo que invierte el orden de bloqueo normal. En segundo lugar, no consider\u00f3 que las notificaciones de POLLFREE se pierdan mientras la solicitud ha sido retirada temporalmente de la cola. El segundo problema lo resolvi\u00f3 mi parche anterior. Luego, este parche corrige adecuadamente el use-after-free al manejar POLLFREE sin interbloqueos. Lo hace aprovechando el hecho de que la liberaci\u00f3n de la cola de espera tiene un retraso de RCU, similar a lo que hace eventpoll.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/aio.c\",\"include/uapi/asm-generic/poll.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2c14fa838cbefc23cf1c73ca167ed85b274b2913\",\"lessThan\":\"321fba81ec034f88aea4898993c1bf15605c023f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2c14fa838cbefc23cf1c73ca167ed85b274b2913\",\"lessThan\":\"4105e6a128e8a98455dfc9e6dbb2ab0c33c4497f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2c14fa838cbefc23cf1c73ca167ed85b274b2913\",\"lessThan\":\"47ffefd88abfffe8a040bcc1dd0554d4ea6f7689\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2c14fa838cbefc23cf1c73ca167ed85b274b2913\",\"lessThan\":\"60d311f9e6381d779d7d53371f87285698ecee24\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2c14fa838cbefc23cf1c73ca167ed85b274b2913\",\"lessThan\":\"50252e4b5e989ce64555c7aef7516bdefc2fea72\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/aio.c\",\"include/uapi/asm-generic/poll.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.221\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.165\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.85\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.8\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-14T18:37:27.922309Z\",\"id\":\"CVE-2021-47505\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.18\",\"versionEndExcluding\":\"4.19.221\",\"matchCriteriaId\":\"2063CE6C-8929-4035-8896-B8ED72601F98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.165\",\"matchCriteriaId\":\"B1DD3148-41FC-42AC-96A5-F63D774A97A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.85\",\"matchCriteriaId\":\"D9668578-08F7-4694-A86F-FCE448387A79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.8\",\"matchCriteriaId\":\"6664ACE2-F748-4AE5-B98B-58803B0B2C3E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"357AA433-37E8-4323-BFB2-3038D6E4B414\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A73429BA-C2D9-4D0C-A75F-06A1CA8B3983\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F621B5E3-E99D-49E7-90B9-EC3B77C95383\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"F7BFDCAA-1650-49AA-8462-407DD593F94F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/321fba81ec034f88aea4898993c1bf15605c023f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4105e6a128e8a98455dfc9e6dbb2ab0c33c4497f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/47ffefd88abfffe8a040bcc1dd0554d4ea6f7689\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/50252e4b5e989ce64555c7aef7516bdefc2fea72\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/60d311f9e6381d779d7d53371f87285698ecee24\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/321fba81ec034f88aea4898993c1bf15605c023f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4105e6a128e8a98455dfc9e6dbb2ab0c33c4497f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/47ffefd88abfffe8a040bcc1dd0554d4ea6f7689\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/50252e4b5e989ce64555c7aef7516bdefc2fea72\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/60d311f9e6381d779d7d53371f87285698ecee24\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:55:57+00:00",
      "cve": "CVE-2021-47505",
      "id": "CVE-2021-47505",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "28",
      "product_status:known_not_affected": "92",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: aio: fix use-after-free due to missing POLLFREE handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47505.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-05T23:43:27Z",
      "cve": "CVE-2021-47505",
      "id": "CVE-2021-47505",
      "initial_release_date": "2024-05-28T03:32:53Z",
      "product_status:known_not_affected": "195",
      "product_status:recommended": "462",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47505",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47505.json",
      "version": "42"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/321fba81ec034f88aea4898993c1bf15605c023f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4105e6a128e8a98455dfc9e6dbb2ab0c33c4497f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/47ffefd88abfffe8a040bcc1dd0554d4ea6f7689\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/60d311f9e6381d779d7d53371f87285698ecee24\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/50252e4b5e989ce64555c7aef7516bdefc2fea72\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:39:59.807Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47505\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-14T18:37:27.922309Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-14T18:37:35.159Z\"}}], \"cna\": {\"title\": \"aio: fix use-after-free due to missing POLLFREE handling\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Triggered via local syscalls (io_setup/io_submit with IOCB_CMD_POLL on a signalfd or binder fd); not reachable from the network stack or remote protocols.\\nAC:L - The attacker fully controls both sides\\u2014submitting the aio poll and freeing the waitqueue (e.g. BINDER_THREAD_EXIT, or exiting a task whose sighand owns the queue while the aio context survives via CLONE_VM)\\u2014so the UAF is reliably inducible.\\nPR:L - io_setup, io_submit, signalfd, and binder ioctls are available to unprivileged users; no CAP_* or root is required along the path.\\nUI:N - Exploitation needs no victim action; the attacker performs all setup and teardown themselves.\\nS:U - Impact is confined to the local kernel/host authority (standard kernel memory corruption / privilege escalation); it does not cross a VM, IOMMU, or other security boundary.\\nC:H - Use-after-free on the waitqueue object enables reclaim and controlled contents, which can be leveraged for arbitrary kernel memory disclosure.\\nI:H - The same UAF is exploitable for heap spray and arbitrary write / control-flow hijacking in the kernel, enabling integrity compromise and code execution.\\nA:H - Accessing the freed waitqueue lock or structure causes kernel oops/panic even without a full exploit, so availability impact is high.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2c14fa838cbefc23cf1c73ca167ed85b274b2913\", \"lessThan\": \"321fba81ec034f88aea4898993c1bf15605c023f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2c14fa838cbefc23cf1c73ca167ed85b274b2913\", \"lessThan\": \"4105e6a128e8a98455dfc9e6dbb2ab0c33c4497f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2c14fa838cbefc23cf1c73ca167ed85b274b2913\", \"lessThan\": \"47ffefd88abfffe8a040bcc1dd0554d4ea6f7689\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2c14fa838cbefc23cf1c73ca167ed85b274b2913\", \"lessThan\": \"60d311f9e6381d779d7d53371f87285698ecee24\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2c14fa838cbefc23cf1c73ca167ed85b274b2913\", \"lessThan\": \"50252e4b5e989ce64555c7aef7516bdefc2fea72\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/aio.c\", \"include/uapi/asm-generic/poll.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.221\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.165\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.85\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/aio.c\", \"include/uapi/asm-generic/poll.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/321fba81ec034f88aea4898993c1bf15605c023f\"}, {\"url\": \"https://git.kernel.org/stable/c/4105e6a128e8a98455dfc9e6dbb2ab0c33c4497f\"}, {\"url\": \"https://git.kernel.org/stable/c/47ffefd88abfffe8a040bcc1dd0554d4ea6f7689\"}, {\"url\": \"https://git.kernel.org/stable/c/60d311f9e6381d779d7d53371f87285698ecee24\"}, {\"url\": \"https://git.kernel.org/stable/c/50252e4b5e989ce64555c7aef7516bdefc2fea72\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\naio: fix use-after-free due to missing POLLFREE handling\\n\\nsignalfd_poll() and binder_poll() are special in that they use a\\nwaitqueue whose lifetime is the current task, rather than the struct\\nfile as is normally the case.  This is okay for blocking polls, since a\\nblocking poll occurs within one task; however, non-blocking polls\\nrequire another solution.  This solution is for the queue to be cleared\\nbefore it is freed, by sending a POLLFREE notification to all waiters.\\n\\nUnfortunately, only eventpoll handles POLLFREE.  A second type of\\nnon-blocking poll, aio poll, was added in kernel v4.18, and it doesn\u0027t\\nhandle POLLFREE.  This allows a use-after-free to occur if a signalfd or\\nbinder fd is polled with aio poll, and the waitqueue gets freed.\\n\\nFix this by making aio poll handle POLLFREE.\\n\\nA patch by Ramji Jiyani \u003cramjiyani@google.com\u003e\\n(https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com)\\ntried to do this by making aio_poll_wake() always complete the request\\ninline if POLLFREE is seen.  However, that solution had two bugs.\\nFirst, it introduced a deadlock, as it unconditionally locked the aio\\ncontext while holding the waitqueue lock, which inverts the normal\\nlocking order.  Second, it didn\u0027t consider that POLLFREE notifications\\nare missed while the request has been temporarily de-queued.\\n\\nThe second problem was solved by my previous patch.  This patch then\\nproperly fixes the use-after-free by handling POLLFREE in a\\ndeadlock-free way.  It does this by taking advantage of the fact that\\nfreeing of the waitqueue is RCU-delayed, similar to what eventpoll does.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.221\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.165\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.85\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.8\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"4.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:48:09.163Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47505\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:48:09.163Z\", \"dateReserved\": \"2024-05-22T06:20:56.205Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-24T15:01:52.088Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.