CVE-2021-47061 (GCVE-0-2021-47061)
Vulnerability from cvelistv5 – Published: 2024-02-29 22:37 – Updated: 2026-08-05 08:45
VLAI
EPSS
VEX
Title
KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU
If allocating a new instance of an I/O bus fails when unregistering a
device, wait to destroy the device until after all readers are guaranteed
to see the new null bus. Destroying devices before the bus is nullified
could lead to use-after-free since readers expect the devices on their
reference of the bus to remain valid.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-08 18:46 UTC
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
f65886606c2d3b562716de030706dfe1bea4ed5e , < 03c6cccedd3913006744faa252a4da5145299343
(git)
Affected: f65886606c2d3b562716de030706dfe1bea4ed5e , < 4e899ca848636b37e9ac124bc1723862a7d7d927 (git) Affected: f65886606c2d3b562716de030706dfe1bea4ed5e , < 30f46c6993731efb2a690c9197c0fd9ed425da2d (git) Affected: f65886606c2d3b562716de030706dfe1bea4ed5e , < 2ee3757424be7c1cd1d0bbfa6db29a7edd82a250 (git) Affected: f0dfffce3f4ffd5f822568a4a6fb34c010e939d1 (git) Affected: 840e124f89a5127e7eb97ebf377f4b8ca745c070 (git) Affected: 40a023f681befd9b2862a3c16fb306a38b359ae5 (git) Affected: 19184bd06f488af62924ff1747614a8cb284ad63 (git) Affected: 41b2ea7a6a11e2b1a7f2c29e1675a709a6b2b98d (git) Affected: 68c125324b5e1d1d22805653735442923d896a1d (git) Affected: 4.4.238 , < 4.5 (semver) Affected: 4.9.238 , < 4.10 (semver) Affected: 4.14.200 , < 4.15 (semver) Affected: 4.19.148 , < 4.20 (semver) Affected: 5.4.66 , < 5.5 (semver) Affected: 5.8.10 , < 5.9 (semver) |
guessed | |
| Linux | Linux |
Affected:
5.9
Unaffected: 0 , < 5.9 (semver) Unaffected: 5.10.37 , ≤ 5.10.* (semver) Unaffected: 5.11.21 , ≤ 5.11.* (semver) Unaffected: 5.12.4 , ≤ 5.12.* (semver) Unaffected: 5.13 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:24:39.011Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-47061",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-08T18:46:02.297393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-08T18:46:13.135Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"virt/kvm/kvm_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "03c6cccedd3913006744faa252a4da5145299343",
"status": "affected",
"version": "f65886606c2d3b562716de030706dfe1bea4ed5e",
"versionType": "git"
},
{
"lessThan": "4e899ca848636b37e9ac124bc1723862a7d7d927",
"status": "affected",
"version": "f65886606c2d3b562716de030706dfe1bea4ed5e",
"versionType": "git"
},
{
"lessThan": "30f46c6993731efb2a690c9197c0fd9ed425da2d",
"status": "affected",
"version": "f65886606c2d3b562716de030706dfe1bea4ed5e",
"versionType": "git"
},
{
"lessThan": "2ee3757424be7c1cd1d0bbfa6db29a7edd82a250",
"status": "affected",
"version": "f65886606c2d3b562716de030706dfe1bea4ed5e",
"versionType": "git"
},
{
"status": "affected",
"version": "f0dfffce3f4ffd5f822568a4a6fb34c010e939d1",
"versionType": "git"
},
{
"status": "affected",
"version": "840e124f89a5127e7eb97ebf377f4b8ca745c070",
"versionType": "git"
},
{
"status": "affected",
"version": "40a023f681befd9b2862a3c16fb306a38b359ae5",
"versionType": "git"
},
{
"status": "affected",
"version": "19184bd06f488af62924ff1747614a8cb284ad63",
"versionType": "git"
},
{
"status": "affected",
"version": "41b2ea7a6a11e2b1a7f2c29e1675a709a6b2b98d",
"versionType": "git"
},
{
"status": "affected",
"version": "68c125324b5e1d1d22805653735442923d896a1d",
"versionType": "git"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.238",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.238",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.200",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.148",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.66",
"versionType": "semver"
},
{
"lessThan": "5.9",
"status": "affected",
"version": "5.8.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"virt/kvm/kvm_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.11.*",
"status": "unaffected",
"version": "5.11.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.12.*",
"status": "unaffected",
"version": "5.12.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.37",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.21",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.12.4",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.13",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.238",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.238",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.200",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.148",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.8.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Destroy I/O bus devices on unregister failure _after_ sync\u0027ing SRCU\n\nIf allocating a new instance of an I/O bus fails when unregistering a\ndevice, wait to destroy the device until after all readers are guaranteed\nto see the new null bus. Destroying devices before the bus is nullified\ncould lead to use-after-free since readers expect the devices on their\nreference of the bus to remain valid."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Reachable only through local KVM ioctls on a VM fd (/dev/kvm \u2192 KVM_CREATE_VM \u2192 KVM_IOEVENTFD or KVM_UNREGISTER_COALESCED_MMIO), not via network packets or unaided guest exits.\nAC:L - An attacker who owns the VM controls both sides (unregister ioctl under slots_lock and concurrent VCPU MMIO/PIO under SRCU) and can induce GFP_KERNEL_ACCOUNT allocation failure via memory pressure/memcg, so the race is attacker-driven.\nPR:L - Requires opening /dev/kvm and creating a VM (typically kvm-group membership), not real root or CAP_SYS_ADMIN; the unregister paths have no additional capability gate.\nUI:N - Exploitation is fully self-driven via the attacker\u2019s own KVM ioctls and VCPU threads; no separate victim action is required.\nS:U - This is host-userspace privilege escalation into the host kernel via the attacker\u2019s VM fd, not a guest-to-host escape across a separate security authority.\nC:H - Use-after-free of heap-backed I/O devices (ioeventfd/coalesced MMIO) while VCPUs still invoke their ops enables reclaim and arbitrary read primitives.\nI:H - The same UAF lets an attacker forge device ops (function pointers) on reclaimed objects during MMIO/PIO emulation, enabling control-flow hijack and arbitrary write.\nA:H - Use-after-free and destroyed-bus list walks cause kernel oops/panic even without full exploitation, fully impacting host availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T08:45:47.418Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343"
},
{
"url": "https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927"
},
{
"url": "https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d"
},
{
"url": "https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250"
}
],
"title": "KVM: Destroy I/O bus devices on unregister failure _after_ sync\u0027ing SRCU",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2021-47061",
"datePublished": "2024-02-29T22:37:35.689Z",
"dateReserved": "2024-02-29T22:33:44.294Z",
"dateUpdated": "2026-08-05T08:45:47.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2021-47061",
"date": "2026-09-16",
"epss": "0.00241",
"percentile": "0.15355"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.9\", \"versionEndExcluding\": \"5.10.37\", \"matchCriteriaId\": \"BFD29FB7-96E7-40B2-A1A7-AFA8D43EC498\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.11.21\", \"matchCriteriaId\": \"8CBB94EC-EC33-4464-99C5-03E5542715F0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.12\", \"versionEndExcluding\": \"5.12.4\", \"matchCriteriaId\": \"D8C7052F-1B7B-4327-9C2B-84EBF3243838\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: Destroy I/O bus devices on unregister failure _after_ sync\u0027ing SRCU\\n\\nIf allocating a new instance of an I/O bus fails when unregistering a\\ndevice, wait to destroy the device until after all readers are guaranteed\\nto see the new null bus. Destroying devices before the bus is nullified\\ncould lead to use-after-free since readers expect the devices on their\\nreference of the bus to remain valid.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: Destruye los dispositivos del bus de E/S al cancelar el registro _despu\\u00e9s_ de sincronizar SRCU Si falla la asignaci\\u00f3n de una nueva instancia de un bus de E/S al cancelar el registro de un dispositivo, espere para destruir el dispositivo hasta que todos los lectores tengan la garant\\u00eda de ver el nuevo bus nulo. Destruir dispositivos antes de que se anule el bus podr\\u00eda dar lugar a un uso posterior a la liberaci\\u00f3n, ya que los lectores esperan que los dispositivos en su referencia del bus sigan siendo v\\u00e1lidos.\"}]",
"id": "CVE-2021-47061",
"lastModified": "2024-12-10T16:55:15.017",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
"published": "2024-02-29T23:15:07.793",
"references": "[{\"url\": \"https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Analyzed",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2021-47061\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-02-29T23:15:07.793\",\"lastModified\":\"2026-08-04T10:16:43.580\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: Destroy I/O bus devices on unregister failure _after_ sync\u0027ing SRCU\\n\\nIf allocating a new instance of an I/O bus fails when unregistering a\\ndevice, wait to destroy the device until after all readers are guaranteed\\nto see the new null bus. Destroying devices before the bus is nullified\\ncould lead to use-after-free since readers expect the devices on their\\nreference of the bus to remain valid.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: Destruye los dispositivos del bus de E/S al cancelar el registro _despu\u00e9s_ de sincronizar SRCU Si falla la asignaci\u00f3n de una nueva instancia de un bus de E/S al cancelar el registro de un dispositivo, espere para destruir el dispositivo hasta que todos los lectores tengan la garant\u00eda de ver el nuevo bus nulo. Destruir dispositivos antes de que se anule el bus podr\u00eda dar lugar a un uso posterior a la liberaci\u00f3n, ya que los lectores esperan que los dispositivos en su referencia del bus sigan siendo v\u00e1lidos.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"virt/kvm/kvm_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f65886606c2d3b562716de030706dfe1bea4ed5e\",\"lessThan\":\"03c6cccedd3913006744faa252a4da5145299343\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f65886606c2d3b562716de030706dfe1bea4ed5e\",\"lessThan\":\"4e899ca848636b37e9ac124bc1723862a7d7d927\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f65886606c2d3b562716de030706dfe1bea4ed5e\",\"lessThan\":\"30f46c6993731efb2a690c9197c0fd9ed425da2d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f65886606c2d3b562716de030706dfe1bea4ed5e\",\"lessThan\":\"2ee3757424be7c1cd1d0bbfa6db29a7edd82a250\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f0dfffce3f4ffd5f822568a4a6fb34c010e939d1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"840e124f89a5127e7eb97ebf377f4b8ca745c070\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"40a023f681befd9b2862a3c16fb306a38b359ae5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"19184bd06f488af62924ff1747614a8cb284ad63\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"41b2ea7a6a11e2b1a7f2c29e1675a709a6b2b98d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"68c125324b5e1d1d22805653735442923d896a1d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.4.238\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.9.238\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.200\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.148\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.66\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.8.10\",\"lessThan\":\"5.9\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"virt/kvm/kvm_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.37\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.11.21\",\"lessThanOrEqual\":\"5.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.12.4\",\"lessThanOrEqual\":\"5.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-08-08T18:46:02.297393Z\",\"id\":\"CVE-2021-47061\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.9\",\"versionEndExcluding\":\"5.10.37\",\"matchCriteriaId\":\"BFD29FB7-96E7-40B2-A1A7-AFA8D43EC498\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.11.21\",\"matchCriteriaId\":\"8CBB94EC-EC33-4464-99C5-03E5542715F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.12\",\"versionEndExcluding\":\"5.12.4\",\"matchCriteriaId\":\"D8C7052F-1B7B-4327-9C2B-84EBF3243838\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-04T20:09:52+00:00",
"cve": "CVE-2021-47061",
"id": "CVE-2021-47061",
"initial_release_date": "2021-01-01T00:00:00+00:00",
"product_status:known_not_affected": "198",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: KVM: use-after-free while destroy I/O bus devices on unregister failure",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47061.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-03T00:46:36Z",
"cve": "CVE-2021-47061",
"id": "CVE-2021-47061",
"initial_release_date": "2024-03-02T05:48:51Z",
"product_status:known_affected": "388",
"product_status:known_not_affected": "320",
"product_status:recommended": "258",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2021-47061",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47061.json",
"version": "56"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:24:39.011Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47061\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-08T18:46:02.297393Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-08T18:46:08.349Z\"}}], \"cna\": {\"title\": \"KVM: Destroy I/O bus devices on unregister failure _after_ sync\u0027ing SRCU\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Reachable only through local KVM ioctls on a VM fd (/dev/kvm \\u2192 KVM_CREATE_VM \\u2192 KVM_IOEVENTFD or KVM_UNREGISTER_COALESCED_MMIO), not via network packets or unaided guest exits.\\nAC:L - An attacker who owns the VM controls both sides (unregister ioctl under slots_lock and concurrent VCPU MMIO/PIO under SRCU) and can induce GFP_KERNEL_ACCOUNT allocation failure via memory pressure/memcg, so the race is attacker-driven.\\nPR:L - Requires opening /dev/kvm and creating a VM (typically kvm-group membership), not real root or CAP_SYS_ADMIN; the unregister paths have no additional capability gate.\\nUI:N - Exploitation is fully self-driven via the attacker\\u2019s own KVM ioctls and VCPU threads; no separate victim action is required.\\nS:U - This is host-userspace privilege escalation into the host kernel via the attacker\\u2019s VM fd, not a guest-to-host escape across a separate security authority.\\nC:H - Use-after-free of heap-backed I/O devices (ioeventfd/coalesced MMIO) while VCPUs still invoke their ops enables reclaim and arbitrary read primitives.\\nI:H - The same UAF lets an attacker forge device ops (function pointers) on reclaimed objects during MMIO/PIO emulation, enabling control-flow hijack and arbitrary write.\\nA:H - Use-after-free and destroyed-bus list walks cause kernel oops/panic even without full exploitation, fully impacting host availability.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f65886606c2d3b562716de030706dfe1bea4ed5e\", \"lessThan\": \"03c6cccedd3913006744faa252a4da5145299343\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f65886606c2d3b562716de030706dfe1bea4ed5e\", \"lessThan\": \"4e899ca848636b37e9ac124bc1723862a7d7d927\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f65886606c2d3b562716de030706dfe1bea4ed5e\", \"lessThan\": \"30f46c6993731efb2a690c9197c0fd9ed425da2d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f65886606c2d3b562716de030706dfe1bea4ed5e\", \"lessThan\": \"2ee3757424be7c1cd1d0bbfa6db29a7edd82a250\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f0dfffce3f4ffd5f822568a4a6fb34c010e939d1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"840e124f89a5127e7eb97ebf377f4b8ca745c070\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"40a023f681befd9b2862a3c16fb306a38b359ae5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"19184bd06f488af62924ff1747614a8cb284ad63\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"41b2ea7a6a11e2b1a7f2c29e1675a709a6b2b98d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"68c125324b5e1d1d22805653735442923d896a1d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.4.238\", \"lessThan\": \"4.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.9.238\", \"lessThan\": \"4.10\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.14.200\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.19.148\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.4.66\", \"lessThan\": \"5.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.8.10\", \"lessThan\": \"5.9\", \"versionType\": \"semver\"}], \"programFiles\": [\"virt/kvm/kvm_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.37\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.11.21\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.11.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"virt/kvm/kvm_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343\"}, {\"url\": \"https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927\"}, {\"url\": \"https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d\"}, {\"url\": \"https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: Destroy I/O bus devices on unregister failure _after_ sync\u0027ing SRCU\\n\\nIf allocating a new instance of an I/O bus fails when unregistering a\\ndevice, wait to destroy the device until after all readers are guaranteed\\nto see the new null bus. Destroying devices before the bus is nullified\\ncould lead to use-after-free since readers expect the devices on their\\nreference of the bus to remain valid.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.37\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.11.21\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.4\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.4.238\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.9.238\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.14.200\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.19.148\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.4.66\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.8.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:45:47.418Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2021-47061\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:45:47.418Z\", \"dateReserved\": \"2024-02-29T22:33:44.294Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-02-29T22:37:35.689Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…