CVE-2021-47226 (GCVE-0-2021-47226)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:19 – Updated: 2026-08-05 08:46
VLAI
Title
x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
Summary
In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer Both Intel and AMD consider it to be architecturally valid for XRSTOR to fail with #PF but nonetheless change the register state. The actual conditions under which this might occur are unclear [1], but it seems plausible that this might be triggered if one sibling thread unmaps a page and invalidates the shared TLB while another sibling thread is executing XRSTOR on the page in question. __fpu__restore_sig() can execute XRSTOR while the hardware registers are preserved on behalf of a different victim task (using the fpu_fpregs_owner_ctx mechanism), and, in theory, XRSTOR could fail but modify the registers. If this happens, then there is a window in which __fpu__restore_sig() could schedule out and the victim task could schedule back in without reloading its own FPU registers. This would result in part of the FPU state that __fpu__restore_sig() was attempting to load leaking into the victim task's user-visible state. Invalidate preserved FPU registers on XRSTOR failure to prevent this situation from corrupting any state. [1] Frequent readers of the errata lists might imagine "complex microarchitectural conditions".
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 1d731e731c4cd7cbd3b1aa295f0932e7610da82f , < a7748e021b9fb7739e3cb88449296539de0b6817 (git)
Affected: 1d731e731c4cd7cbd3b1aa295f0932e7610da82f , < 002665dcba4bbec8c82f0aeb4bd3f44334ed2c14 (git)
Affected: 1d731e731c4cd7cbd3b1aa295f0932e7610da82f , < d8778e393afa421f1f117471144f8ce6deb6953a (git)
Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 5.10.46 , ≤ 5.10.* (semver)
Unaffected: 5.12.13 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47226",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T15:36:03.024870Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:15:21.177Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.454Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a7748e021b9fb7739e3cb88449296539de0b6817"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/002665dcba4bbec8c82f0aeb4bd3f44334ed2c14"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d8778e393afa421f1f117471144f8ce6deb6953a"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/fpu/signal.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a7748e021b9fb7739e3cb88449296539de0b6817",
              "status": "affected",
              "version": "1d731e731c4cd7cbd3b1aa295f0932e7610da82f",
              "versionType": "git"
            },
            {
              "lessThan": "002665dcba4bbec8c82f0aeb4bd3f44334ed2c14",
              "status": "affected",
              "version": "1d731e731c4cd7cbd3b1aa295f0932e7610da82f",
              "versionType": "git"
            },
            {
              "lessThan": "d8778e393afa421f1f117471144f8ce6deb6953a",
              "status": "affected",
              "version": "1d731e731c4cd7cbd3b1aa295f0932e7610da82f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/fpu/signal.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.46",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.13",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer\n\nBoth Intel and AMD consider it to be architecturally valid for XRSTOR to\nfail with #PF but nonetheless change the register state.  The actual\nconditions under which this might occur are unclear [1], but it seems\nplausible that this might be triggered if one sibling thread unmaps a page\nand invalidates the shared TLB while another sibling thread is executing\nXRSTOR on the page in question.\n\n__fpu__restore_sig() can execute XRSTOR while the hardware registers\nare preserved on behalf of a different victim task (using the\nfpu_fpregs_owner_ctx mechanism), and, in theory, XRSTOR could fail but\nmodify the registers.\n\nIf this happens, then there is a window in which __fpu__restore_sig()\ncould schedule out and the victim task could schedule back in without\nreloading its own FPU registers. This would result in part of the FPU\nstate that __fpu__restore_sig() was attempting to load leaking into the\nvictim task\u0027s user-visible state.\n\nInvalidate preserved FPU registers on XRSTOR failure to prevent this\nsituation from corrupting any state.\n\n[1] Frequent readers of the errata lists might imagine \"complex\n    microarchitectural conditions\"."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached only via the local rt_sigreturn/sigreturn syscalls into __fpu__restore_sig(); it cannot be triggered by network packets or remote protocols.\nAC:L - An unprivileged attacker can reliably set up both sides of the race (one thread performing sigreturn XRSTOR while a sibling unmaps the buffer/TLB) and retry until the architecturally allowed partial XRSTOR-on-#PF occurs.\nPR:L - Any unprivileged local user can invoke rt_sigreturn and supply a crafted signal frame; no capabilities or root privileges are required.\nUI:N - Exploitation requires only the attacker\u0027s own threads and normal scheduling alongside other tasks; no separate victim user action is needed.\nS:U - Impact stays within the kernel\u0027s process-management authority (cross-task FPU register corruption on the same OS); this is not a VM/hypervisor or IOMMU boundary escape.\nC:N - The flaw injects attacker-controlled FPU/SIMD state into another task\u0027s registers; it does not provide a primitive for the attacker to read victim or kernel memory.\nI:H - Failed XRSTOR can write attacker-chosen user xstate (FP/SSE/AVX and related features) into hardware registers still attributed to a victim task, which then resumes with corrupted, attacker-influenced register state.\nA:H - Corrupting another task\u0027s FPU/MXCSR/SIMD state can cause that process to fault, abort, or otherwise fail, enabling cross-process denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:49.937Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a7748e021b9fb7739e3cb88449296539de0b6817"
        },
        {
          "url": "https://git.kernel.org/stable/c/002665dcba4bbec8c82f0aeb4bd3f44334ed2c14"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8778e393afa421f1f117471144f8ce6deb6953a"
        }
      ],
      "title": "x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47226",
    "datePublished": "2024-05-21T14:19:30.864Z",
    "dateReserved": "2024-04-10T18:59:19.529Z",
    "dateUpdated": "2026-08-05T08:46:49.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47226",
      "date": "2026-08-11",
      "epss": "0.00222",
      "percentile": "0.12916"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer\\n\\nBoth Intel and AMD consider it to be architecturally valid for XRSTOR to\\nfail with #PF but nonetheless change the register state.  The actual\\nconditions under which this might occur are unclear [1], but it seems\\nplausible that this might be triggered if one sibling thread unmaps a page\\nand invalidates the shared TLB while another sibling thread is executing\\nXRSTOR on the page in question.\\n\\n__fpu__restore_sig() can execute XRSTOR while the hardware registers\\nare preserved on behalf of a different victim task (using the\\nfpu_fpregs_owner_ctx mechanism), and, in theory, XRSTOR could fail but\\nmodify the registers.\\n\\nIf this happens, then there is a window in which __fpu__restore_sig()\\ncould schedule out and the victim task could schedule back in without\\nreloading its own FPU registers. This would result in part of the FPU\\nstate that __fpu__restore_sig() was attempting to load leaking into the\\nvictim task\u0027s user-visible state.\\n\\nInvalidate preserved FPU registers on XRSTOR failure to prevent this\\nsituation from corrupting any state.\\n\\n[1] Frequent readers of the errata lists might imagine \\\"complex\\n    microarchitectural conditions\\\".\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/fpu: Invalida el estado de la FPU despu\\u00e9s de un XRSTOR fallido desde un b\\u00fafer de usuario. Tanto Intel como AMD consideran que es arquitect\\u00f3nicamente v\\u00e1lido que XRSTOR falle con #PF pero aun as\\u00ed cambie el estado del registro. . Las condiciones reales bajo las cuales esto podr\\u00eda ocurrir no est\\u00e1n claras [1], pero parece plausible que esto pueda desencadenarse si un hilo hermano desasigna una p\\u00e1gina e invalida el TLB compartido mientras otro hilo hermano est\\u00e1 ejecutando XRSTOR en la p\\u00e1gina en cuesti\\u00f3n. __fpu__restore_sig() puede ejecutar XRSTOR mientras los registros de hardware se conservan en nombre de una tarea de v\\u00edctima diferente (usando el mecanismo fpu_fpregs_owner_ctx) y, en teor\\u00eda, XRSTOR podr\\u00eda fallar pero modificar los registros. Si esto sucede, entonces hay una ventana en la que __fpu__restore_sig() podr\\u00eda programar la salida y la tarea de la v\\u00edctima podr\\u00eda volver a programarse sin recargar sus propios registros FPU. Esto resultar\\u00eda en parte del estado de la FPU en el que __fpu__restore_sig() intentaba cargar una filtraci\\u00f3n en el estado visible para el usuario de la tarea de la v\\u00edctima. Invalide los registros FPU preservados en caso de falla de XRSTOR para evitar que esta situaci\\u00f3n corrompa cualquier estado. [1] Los lectores frecuentes de las listas de erratas podr\\u00edan imaginar \\\"condiciones microarquitect\\u00f3nicas complejas\\\".\"}]",
      "id": "CVE-2021-47226",
      "lastModified": "2024-11-21T06:35:39.977",
      "published": "2024-05-21T15:15:11.823",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/002665dcba4bbec8c82f0aeb4bd3f44334ed2c14\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a7748e021b9fb7739e3cb88449296539de0b6817\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d8778e393afa421f1f117471144f8ce6deb6953a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/002665dcba4bbec8c82f0aeb4bd3f44334ed2c14\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a7748e021b9fb7739e3cb88449296539de0b6817\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d8778e393afa421f1f117471144f8ce6deb6953a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47226\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T15:15:11.823\",\"lastModified\":\"2026-08-04T10:16:53.647\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer\\n\\nBoth Intel and AMD consider it to be architecturally valid for XRSTOR to\\nfail with #PF but nonetheless change the register state.  The actual\\nconditions under which this might occur are unclear [1], but it seems\\nplausible that this might be triggered if one sibling thread unmaps a page\\nand invalidates the shared TLB while another sibling thread is executing\\nXRSTOR on the page in question.\\n\\n__fpu__restore_sig() can execute XRSTOR while the hardware registers\\nare preserved on behalf of a different victim task (using the\\nfpu_fpregs_owner_ctx mechanism), and, in theory, XRSTOR could fail but\\nmodify the registers.\\n\\nIf this happens, then there is a window in which __fpu__restore_sig()\\ncould schedule out and the victim task could schedule back in without\\nreloading its own FPU registers. This would result in part of the FPU\\nstate that __fpu__restore_sig() was attempting to load leaking into the\\nvictim task\u0027s user-visible state.\\n\\nInvalidate preserved FPU registers on XRSTOR failure to prevent this\\nsituation from corrupting any state.\\n\\n[1] Frequent readers of the errata lists might imagine \\\"complex\\n    microarchitectural conditions\\\".\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/fpu: Invalida el estado de la FPU despu\u00e9s de un XRSTOR fallido desde un b\u00fafer de usuario. Tanto Intel como AMD consideran que es arquitect\u00f3nicamente v\u00e1lido que XRSTOR falle con #PF pero aun as\u00ed cambie el estado del registro. . Las condiciones reales bajo las cuales esto podr\u00eda ocurrir no est\u00e1n claras [1], pero parece plausible que esto pueda desencadenarse si un hilo hermano desasigna una p\u00e1gina e invalida el TLB compartido mientras otro hilo hermano est\u00e1 ejecutando XRSTOR en la p\u00e1gina en cuesti\u00f3n. __fpu__restore_sig() puede ejecutar XRSTOR mientras los registros de hardware se conservan en nombre de una tarea de v\u00edctima diferente (usando el mecanismo fpu_fpregs_owner_ctx) y, en teor\u00eda, XRSTOR podr\u00eda fallar pero modificar los registros. Si esto sucede, entonces hay una ventana en la que __fpu__restore_sig() podr\u00eda programar la salida y la tarea de la v\u00edctima podr\u00eda volver a programarse sin recargar sus propios registros FPU. Esto resultar\u00eda en parte del estado de la FPU en el que __fpu__restore_sig() intentaba cargar una filtraci\u00f3n en el estado visible para el usuario de la tarea de la v\u00edctima. Invalide los registros FPU preservados en caso de falla de XRSTOR para evitar que esta situaci\u00f3n corrompa cualquier estado. [1] Los lectores frecuentes de las listas de erratas podr\u00edan imaginar \\\"condiciones microarquitect\u00f3nicas complejas\\\".\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kernel/fpu/signal.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1d731e731c4cd7cbd3b1aa295f0932e7610da82f\",\"lessThan\":\"a7748e021b9fb7739e3cb88449296539de0b6817\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d731e731c4cd7cbd3b1aa295f0932e7610da82f\",\"lessThan\":\"002665dcba4bbec8c82f0aeb4bd3f44334ed2c14\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d731e731c4cd7cbd3b1aa295f0932e7610da82f\",\"lessThan\":\"d8778e393afa421f1f117471144f8ce6deb6953a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kernel/fpu/signal.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.46\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.12.13\",\"lessThanOrEqual\":\"5.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-21T15:36:03.024870Z\",\"id\":\"CVE-2021-47226\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-203\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.2\",\"versionEndExcluding\":\"5.10.46\",\"matchCriteriaId\":\"71A9FF74-A7CD-4A97-B822-6302C3124C48\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.12.13\",\"matchCriteriaId\":\"7806E7E5-6D4F-4E18-81C1-79B3C60EE855\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"96AC23B2-D46A-49D9-8203-8E1BEDCA8532\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA610E30-717C-4700-9F77-A3C9244F3BFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1ECD33F5-85BE-430B-8F86-8D7BD560311D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF351855-2437-4CF5-AD7C-BDFA51F27683\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"25A855BA-2118-44F2-90EF-EBBB12AF51EF\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/002665dcba4bbec8c82f0aeb4bd3f44334ed2c14\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7748e021b9fb7739e3cb88449296539de0b6817\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d8778e393afa421f1f117471144f8ce6deb6953a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/002665dcba4bbec8c82f0aeb4bd3f44334ed2c14\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7748e021b9fb7739e3cb88449296539de0b6817\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d8778e393afa421f1f117471144f8ce6deb6953a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-07T23:51:47+00:00",
      "cve": "CVE-2021-47226",
      "id": "CVE-2021-47226",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:fixed": "120",
      "product_status:known_affected": "124",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47226.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:22:15Z",
      "cve": "CVE-2021-47226",
      "id": "CVE-2021-47226",
      "initial_release_date": "2024-05-23T03:05:38Z",
      "product_status:known_affected": "55",
      "product_status:known_not_affected": "271",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47226",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47226.json",
      "version": "27"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a7748e021b9fb7739e3cb88449296539de0b6817\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/002665dcba4bbec8c82f0aeb4bd3f44334ed2c14\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d8778e393afa421f1f117471144f8ce6deb6953a\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:07.454Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47226\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-21T15:36:03.024870Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:25.194Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is reached only via the local rt_sigreturn/sigreturn syscalls into __fpu__restore_sig(); it cannot be triggered by network packets or remote protocols.\\nAC:L - An unprivileged attacker can reliably set up both sides of the race (one thread performing sigreturn XRSTOR while a sibling unmaps the buffer/TLB) and retry until the architecturally allowed partial XRSTOR-on-#PF occurs.\\nPR:L - Any unprivileged local user can invoke rt_sigreturn and supply a crafted signal frame; no capabilities or root privileges are required.\\nUI:N - Exploitation requires only the attacker\u0027s own threads and normal scheduling alongside other tasks; no separate victim user action is needed.\\nS:U - Impact stays within the kernel\u0027s process-management authority (cross-task FPU register corruption on the same OS); this is not a VM/hypervisor or IOMMU boundary escape.\\nC:N - The flaw injects attacker-controlled FPU/SIMD state into another task\u0027s registers; it does not provide a primitive for the attacker to read victim or kernel memory.\\nI:H - Failed XRSTOR can write attacker-chosen user xstate (FP/SSE/AVX and related features) into hardware registers still attributed to a victim task, which then resumes with corrupted, attacker-influenced register state.\\nA:H - Corrupting another task\u0027s FPU/MXCSR/SIMD state can cause that process to fault, abort, or otherwise fail, enabling cross-process denial of service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1d731e731c4cd7cbd3b1aa295f0932e7610da82f\", \"lessThan\": \"a7748e021b9fb7739e3cb88449296539de0b6817\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1d731e731c4cd7cbd3b1aa295f0932e7610da82f\", \"lessThan\": \"002665dcba4bbec8c82f0aeb4bd3f44334ed2c14\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1d731e731c4cd7cbd3b1aa295f0932e7610da82f\", \"lessThan\": \"d8778e393afa421f1f117471144f8ce6deb6953a\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/x86/kernel/fpu/signal.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.46\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/x86/kernel/fpu/signal.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a7748e021b9fb7739e3cb88449296539de0b6817\"}, {\"url\": \"https://git.kernel.org/stable/c/002665dcba4bbec8c82f0aeb4bd3f44334ed2c14\"}, {\"url\": \"https://git.kernel.org/stable/c/d8778e393afa421f1f117471144f8ce6deb6953a\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer\\n\\nBoth Intel and AMD consider it to be architecturally valid for XRSTOR to\\nfail with #PF but nonetheless change the register state.  The actual\\nconditions under which this might occur are unclear [1], but it seems\\nplausible that this might be triggered if one sibling thread unmaps a page\\nand invalidates the shared TLB while another sibling thread is executing\\nXRSTOR on the page in question.\\n\\n__fpu__restore_sig() can execute XRSTOR while the hardware registers\\nare preserved on behalf of a different victim task (using the\\nfpu_fpregs_owner_ctx mechanism), and, in theory, XRSTOR could fail but\\nmodify the registers.\\n\\nIf this happens, then there is a window in which __fpu__restore_sig()\\ncould schedule out and the victim task could schedule back in without\\nreloading its own FPU registers. This would result in part of the FPU\\nstate that __fpu__restore_sig() was attempting to load leaking into the\\nvictim task\u0027s user-visible state.\\n\\nInvalidate preserved FPU registers on XRSTOR failure to prevent this\\nsituation from corrupting any state.\\n\\n[1] Frequent readers of the errata lists might imagine \\\"complex\\n    microarchitectural conditions\\\".\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.46\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.13\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13\", \"versionStartIncluding\": \"5.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:46:49.937Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47226\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:46:49.937Z\", \"dateReserved\": \"2024-04-10T18:59:19.529Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T14:19:30.864Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.