CVE-2021-47061 (GCVE-0-2021-47061)

Vulnerability from cvelistv5 – Published: 2024-02-29 22:37 – Updated: 2026-08-05 08:45
VLAI
Title
KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU If allocating a new instance of an I/O bus fails when unregistering a device, wait to destroy the device until after all readers are guaranteed to see the new null bus. Destroying devices before the bus is nullified could lead to use-after-free since readers expect the devices on their reference of the bus to remain valid.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-08 18:46 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: f65886606c2d3b562716de030706dfe1bea4ed5e , < 03c6cccedd3913006744faa252a4da5145299343 (git)
Affected: f65886606c2d3b562716de030706dfe1bea4ed5e , < 4e899ca848636b37e9ac124bc1723862a7d7d927 (git)
Affected: f65886606c2d3b562716de030706dfe1bea4ed5e , < 30f46c6993731efb2a690c9197c0fd9ed425da2d (git)
Affected: f65886606c2d3b562716de030706dfe1bea4ed5e , < 2ee3757424be7c1cd1d0bbfa6db29a7edd82a250 (git)
Affected: f0dfffce3f4ffd5f822568a4a6fb34c010e939d1 (git)
Affected: 840e124f89a5127e7eb97ebf377f4b8ca745c070 (git)
Affected: 40a023f681befd9b2862a3c16fb306a38b359ae5 (git)
Affected: 19184bd06f488af62924ff1747614a8cb284ad63 (git)
Affected: 41b2ea7a6a11e2b1a7f2c29e1675a709a6b2b98d (git)
Affected: 68c125324b5e1d1d22805653735442923d896a1d (git)
Affected: 4.4.238 , < 4.5 (semver)
Affected: 4.9.238 , < 4.10 (semver)
Affected: 4.14.200 , < 4.15 (semver)
Affected: 4.19.148 , < 4.20 (semver)
Affected: 5.4.66 , < 5.5 (semver)
Affected: 5.8.10 , < 5.9 (semver)
Create a notification for this product.
Linux Linux Affected: 5.9
Unaffected: 0 , < 5.9 (semver)
Unaffected: 5.10.37 , ≤ 5.10.* (semver)
Unaffected: 5.11.21 , ≤ 5.11.* (semver)
Unaffected: 5.12.4 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:39.011Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47061",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-08T18:46:02.297393Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-08T18:46:13.135Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "virt/kvm/kvm_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "03c6cccedd3913006744faa252a4da5145299343",
              "status": "affected",
              "version": "f65886606c2d3b562716de030706dfe1bea4ed5e",
              "versionType": "git"
            },
            {
              "lessThan": "4e899ca848636b37e9ac124bc1723862a7d7d927",
              "status": "affected",
              "version": "f65886606c2d3b562716de030706dfe1bea4ed5e",
              "versionType": "git"
            },
            {
              "lessThan": "30f46c6993731efb2a690c9197c0fd9ed425da2d",
              "status": "affected",
              "version": "f65886606c2d3b562716de030706dfe1bea4ed5e",
              "versionType": "git"
            },
            {
              "lessThan": "2ee3757424be7c1cd1d0bbfa6db29a7edd82a250",
              "status": "affected",
              "version": "f65886606c2d3b562716de030706dfe1bea4ed5e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f0dfffce3f4ffd5f822568a4a6fb34c010e939d1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "840e124f89a5127e7eb97ebf377f4b8ca745c070",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "40a023f681befd9b2862a3c16fb306a38b359ae5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "19184bd06f488af62924ff1747614a8cb284ad63",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "41b2ea7a6a11e2b1a7f2c29e1675a709a6b2b98d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "68c125324b5e1d1d22805653735442923d896a1d",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.238",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.238",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.200",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.148",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.66",
              "versionType": "semver"
            },
            {
              "lessThan": "5.9",
              "status": "affected",
              "version": "5.8.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "virt/kvm/kvm_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.11.*",
              "status": "unaffected",
              "version": "5.11.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.37",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.21",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.4",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.238",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.238",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.200",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.148",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.66",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.8.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Destroy I/O bus devices on unregister failure _after_ sync\u0027ing SRCU\n\nIf allocating a new instance of an I/O bus fails when unregistering a\ndevice, wait to destroy the device until after all readers are guaranteed\nto see the new null bus.  Destroying devices before the bus is nullified\ncould lead to use-after-free since readers expect the devices on their\nreference of the bus to remain valid."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachable only through local KVM ioctls on a VM fd (/dev/kvm \u2192 KVM_CREATE_VM \u2192 KVM_IOEVENTFD or KVM_UNREGISTER_COALESCED_MMIO), not via network packets or unaided guest exits.\nAC:L - An attacker who owns the VM controls both sides (unregister ioctl under slots_lock and concurrent VCPU MMIO/PIO under SRCU) and can induce GFP_KERNEL_ACCOUNT allocation failure via memory pressure/memcg, so the race is attacker-driven.\nPR:L - Requires opening /dev/kvm and creating a VM (typically kvm-group membership), not real root or CAP_SYS_ADMIN; the unregister paths have no additional capability gate.\nUI:N - Exploitation is fully self-driven via the attacker\u2019s own KVM ioctls and VCPU threads; no separate victim action is required.\nS:U - This is host-userspace privilege escalation into the host kernel via the attacker\u2019s VM fd, not a guest-to-host escape across a separate security authority.\nC:H - Use-after-free of heap-backed I/O devices (ioeventfd/coalesced MMIO) while VCPUs still invoke their ops enables reclaim and arbitrary read primitives.\nI:H - The same UAF lets an attacker forge device ops (function pointers) on reclaimed objects during MMIO/PIO emulation, enabling control-flow hijack and arbitrary write.\nA:H - Use-after-free and destroyed-bus list walks cause kernel oops/panic even without full exploitation, fully impacting host availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:45:47.418Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927"
        },
        {
          "url": "https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250"
        }
      ],
      "title": "KVM: Destroy I/O bus devices on unregister failure _after_ sync\u0027ing SRCU",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47061",
    "datePublished": "2024-02-29T22:37:35.689Z",
    "dateReserved": "2024-02-29T22:33:44.294Z",
    "dateUpdated": "2026-08-05T08:45:47.418Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47061",
      "date": "2026-08-13",
      "epss": "0.00241",
      "percentile": "0.15293"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.9\", \"versionEndExcluding\": \"5.10.37\", \"matchCriteriaId\": \"BFD29FB7-96E7-40B2-A1A7-AFA8D43EC498\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.11.21\", \"matchCriteriaId\": \"8CBB94EC-EC33-4464-99C5-03E5542715F0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.12\", \"versionEndExcluding\": \"5.12.4\", \"matchCriteriaId\": \"D8C7052F-1B7B-4327-9C2B-84EBF3243838\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: Destroy I/O bus devices on unregister failure _after_ sync\u0027ing SRCU\\n\\nIf allocating a new instance of an I/O bus fails when unregistering a\\ndevice, wait to destroy the device until after all readers are guaranteed\\nto see the new null bus.  Destroying devices before the bus is nullified\\ncould lead to use-after-free since readers expect the devices on their\\nreference of the bus to remain valid.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: Destruye los dispositivos del bus de E/S al cancelar el registro _despu\\u00e9s_ de sincronizar SRCU Si falla la asignaci\\u00f3n de una nueva instancia de un bus de E/S al cancelar el registro de un dispositivo, espere para destruir el dispositivo hasta que todos los lectores tengan la garant\\u00eda de ver el nuevo bus nulo. Destruir dispositivos antes de que se anule el bus podr\\u00eda dar lugar a un uso posterior a la liberaci\\u00f3n, ya que los lectores esperan que los dispositivos en su referencia del bus sigan siendo v\\u00e1lidos.\"}]",
      "id": "CVE-2021-47061",
      "lastModified": "2024-12-10T16:55:15.017",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-02-29T23:15:07.793",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47061\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-02-29T23:15:07.793\",\"lastModified\":\"2026-08-04T10:16:43.580\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: Destroy I/O bus devices on unregister failure _after_ sync\u0027ing SRCU\\n\\nIf allocating a new instance of an I/O bus fails when unregistering a\\ndevice, wait to destroy the device until after all readers are guaranteed\\nto see the new null bus.  Destroying devices before the bus is nullified\\ncould lead to use-after-free since readers expect the devices on their\\nreference of the bus to remain valid.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: Destruye los dispositivos del bus de E/S al cancelar el registro _despu\u00e9s_ de sincronizar SRCU Si falla la asignaci\u00f3n de una nueva instancia de un bus de E/S al cancelar el registro de un dispositivo, espere para destruir el dispositivo hasta que todos los lectores tengan la garant\u00eda de ver el nuevo bus nulo. Destruir dispositivos antes de que se anule el bus podr\u00eda dar lugar a un uso posterior a la liberaci\u00f3n, ya que los lectores esperan que los dispositivos en su referencia del bus sigan siendo v\u00e1lidos.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"virt/kvm/kvm_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f65886606c2d3b562716de030706dfe1bea4ed5e\",\"lessThan\":\"03c6cccedd3913006744faa252a4da5145299343\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f65886606c2d3b562716de030706dfe1bea4ed5e\",\"lessThan\":\"4e899ca848636b37e9ac124bc1723862a7d7d927\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f65886606c2d3b562716de030706dfe1bea4ed5e\",\"lessThan\":\"30f46c6993731efb2a690c9197c0fd9ed425da2d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f65886606c2d3b562716de030706dfe1bea4ed5e\",\"lessThan\":\"2ee3757424be7c1cd1d0bbfa6db29a7edd82a250\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f0dfffce3f4ffd5f822568a4a6fb34c010e939d1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"840e124f89a5127e7eb97ebf377f4b8ca745c070\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"40a023f681befd9b2862a3c16fb306a38b359ae5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"19184bd06f488af62924ff1747614a8cb284ad63\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"41b2ea7a6a11e2b1a7f2c29e1675a709a6b2b98d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"68c125324b5e1d1d22805653735442923d896a1d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.4.238\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.9.238\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.200\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.148\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.66\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.8.10\",\"lessThan\":\"5.9\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"virt/kvm/kvm_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.37\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.11.21\",\"lessThanOrEqual\":\"5.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.12.4\",\"lessThanOrEqual\":\"5.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-08-08T18:46:02.297393Z\",\"id\":\"CVE-2021-47061\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.9\",\"versionEndExcluding\":\"5.10.37\",\"matchCriteriaId\":\"BFD29FB7-96E7-40B2-A1A7-AFA8D43EC498\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.11.21\",\"matchCriteriaId\":\"8CBB94EC-EC33-4464-99C5-03E5542715F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.12\",\"versionEndExcluding\":\"5.12.4\",\"matchCriteriaId\":\"D8C7052F-1B7B-4327-9C2B-84EBF3243838\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T20:09:52+00:00",
      "cve": "CVE-2021-47061",
      "id": "CVE-2021-47061",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: use-after-free while destroy I/O bus devices on unregister failure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47061.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T02:08:41Z",
      "cve": "CVE-2021-47061",
      "id": "CVE-2021-47061",
      "initial_release_date": "2024-03-02T05:48:51Z",
      "product_status:known_affected": "388",
      "product_status:known_not_affected": "273",
      "product_status:recommended": "258",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47061",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47061.json",
      "version": "54"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:24:39.011Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47061\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-08T18:46:02.297393Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-08T18:46:08.349Z\"}}], \"cna\": {\"title\": \"KVM: Destroy I/O bus devices on unregister failure _after_ sync\u0027ing SRCU\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Reachable only through local KVM ioctls on a VM fd (/dev/kvm \\u2192 KVM_CREATE_VM \\u2192 KVM_IOEVENTFD or KVM_UNREGISTER_COALESCED_MMIO), not via network packets or unaided guest exits.\\nAC:L - An attacker who owns the VM controls both sides (unregister ioctl under slots_lock and concurrent VCPU MMIO/PIO under SRCU) and can induce GFP_KERNEL_ACCOUNT allocation failure via memory pressure/memcg, so the race is attacker-driven.\\nPR:L - Requires opening /dev/kvm and creating a VM (typically kvm-group membership), not real root or CAP_SYS_ADMIN; the unregister paths have no additional capability gate.\\nUI:N - Exploitation is fully self-driven via the attacker\\u2019s own KVM ioctls and VCPU threads; no separate victim action is required.\\nS:U - This is host-userspace privilege escalation into the host kernel via the attacker\\u2019s VM fd, not a guest-to-host escape across a separate security authority.\\nC:H - Use-after-free of heap-backed I/O devices (ioeventfd/coalesced MMIO) while VCPUs still invoke their ops enables reclaim and arbitrary read primitives.\\nI:H - The same UAF lets an attacker forge device ops (function pointers) on reclaimed objects during MMIO/PIO emulation, enabling control-flow hijack and arbitrary write.\\nA:H - Use-after-free and destroyed-bus list walks cause kernel oops/panic even without full exploitation, fully impacting host availability.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f65886606c2d3b562716de030706dfe1bea4ed5e\", \"lessThan\": \"03c6cccedd3913006744faa252a4da5145299343\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f65886606c2d3b562716de030706dfe1bea4ed5e\", \"lessThan\": \"4e899ca848636b37e9ac124bc1723862a7d7d927\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f65886606c2d3b562716de030706dfe1bea4ed5e\", \"lessThan\": \"30f46c6993731efb2a690c9197c0fd9ed425da2d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f65886606c2d3b562716de030706dfe1bea4ed5e\", \"lessThan\": \"2ee3757424be7c1cd1d0bbfa6db29a7edd82a250\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f0dfffce3f4ffd5f822568a4a6fb34c010e939d1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"840e124f89a5127e7eb97ebf377f4b8ca745c070\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"40a023f681befd9b2862a3c16fb306a38b359ae5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"19184bd06f488af62924ff1747614a8cb284ad63\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"41b2ea7a6a11e2b1a7f2c29e1675a709a6b2b98d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"68c125324b5e1d1d22805653735442923d896a1d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.4.238\", \"lessThan\": \"4.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.9.238\", \"lessThan\": \"4.10\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.14.200\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.19.148\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.4.66\", \"lessThan\": \"5.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.8.10\", \"lessThan\": \"5.9\", \"versionType\": \"semver\"}], \"programFiles\": [\"virt/kvm/kvm_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.37\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.11.21\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.11.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"virt/kvm/kvm_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343\"}, {\"url\": \"https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927\"}, {\"url\": \"https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d\"}, {\"url\": \"https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: Destroy I/O bus devices on unregister failure _after_ sync\u0027ing SRCU\\n\\nIf allocating a new instance of an I/O bus fails when unregistering a\\ndevice, wait to destroy the device until after all readers are guaranteed\\nto see the new null bus.  Destroying devices before the bus is nullified\\ncould lead to use-after-free since readers expect the devices on their\\nreference of the bus to remain valid.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.37\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.11.21\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.4\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.4.238\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.9.238\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.14.200\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.19.148\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.4.66\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.8.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:45:47.418Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47061\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:45:47.418Z\", \"dateReserved\": \"2024-02-29T22:33:44.294Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-02-29T22:37:35.689Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.