CVE-2021-47268 (GCVE-0-2021-47268)
Vulnerability from cvelistv5 – Published: 2024-05-21 14:19 – Updated: 2026-05-11 13:51
VLAI
EPSS
VEX
Title
usb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port
A pending hrtimer may expire after the kthread_worker of tcpm port
is destroyed, see below kernel dump when do module unload, fix it
by cancel the 2 hrtimers.
[ 111.517018] Unable to handle kernel paging request at virtual address ffff8000118cb880
[ 111.518786] blk_update_request: I/O error, dev sda, sector 60061185 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[ 111.526594] Mem abort info:
[ 111.526597] ESR = 0x96000047
[ 111.526600] EC = 0x25: DABT (current EL), IL = 32 bits
[ 111.526604] SET = 0, FnV = 0
[ 111.526607] EA = 0, S1PTW = 0
[ 111.526610] Data abort info:
[ 111.526612] ISV = 0, ISS = 0x00000047
[ 111.526615] CM = 0, WnR = 1
[ 111.526619] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041d75000
[ 111.526623] [ffff8000118cb880] pgd=10000001bffff003, p4d=10000001bffff003, pud=10000001bfffe003, pmd=10000001bfffa003, pte=0000000000000000
[ 111.526642] Internal error: Oops: 96000047 [#1] PREEMPT SMP
[ 111.526647] Modules linked in: dwc3_imx8mp dwc3 phy_fsl_imx8mq_usb [last unloaded: tcpci]
[ 111.526663] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.13.0-rc4-00927-gebbe9dbd802c-dirty #36
[ 111.526670] Hardware name: NXP i.MX8MPlus EVK board (DT)
[ 111.526674] pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO BTYPE=--)
[ 111.526681] pc : queued_spin_lock_slowpath+0x1a0/0x390
[ 111.526695] lr : _raw_spin_lock_irqsave+0x88/0xb4
[ 111.526703] sp : ffff800010003e20
[ 111.526706] x29: ffff800010003e20 x28: ffff00017f380180
[ 111.537156] buffer_io_error: 6 callbacks suppressed
[ 111.537162] Buffer I/O error on dev sda1, logical block 60040704, async page read
[ 111.539932] x27: ffff00017f3801c0
[ 111.539938] x26: ffff800010ba2490 x25: 0000000000000000 x24: 0000000000000001
[ 111.543025] blk_update_request: I/O error, dev sda, sector 60061186 op 0x0:(READ) flags 0x0 phys_seg 7 prio class 0
[ 111.548304]
[ 111.548306] x23: 00000000000000c0 x22: ffff0000c2a9f184 x21: ffff00017f380180
[ 111.551374] Buffer I/O error on dev sda1, logical block 60040705, async page read
[ 111.554499]
[ 111.554503] x20: ffff0000c5f14210 x19: 00000000000000c0 x18: 0000000000000000
[ 111.557391] Buffer I/O error on dev sda1, logical block 60040706, async page read
[ 111.561218]
[ 111.561222] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
[ 111.564205] Buffer I/O error on dev sda1, logical block 60040707, async page read
[ 111.570887] x14: 00000000000000f5 x13: 0000000000000001 x12: 0000000000000040
[ 111.570902] x11: ffff0000c05ac6d8
[ 111.583420] Buffer I/O error on dev sda1, logical block 60040708, async page read
[ 111.588978] x10: 0000000000000000 x9 : 0000000000040000
[ 111.588988] x8 : 0000000000000000
[ 111.597173] Buffer I/O error on dev sda1, logical block 60040709, async page read
[ 111.605766] x7 : ffff00017f384880 x6 : ffff8000118cb880
[ 111.605777] x5 : ffff00017f384880
[ 111.611094] Buffer I/O error on dev sda1, logical block 60040710, async page read
[ 111.617086] x4 : 0000000000000000 x3 : ffff0000c2a9f184
[ 111.617096] x2 : ffff8000118cb880
[ 111.622242] Buffer I/O error on dev sda1, logical block 60040711, async page read
[ 111.626927] x1 : ffff8000118cb880 x0 : ffff00017f384888
[ 111.626938] Call trace:
[ 111.626942] queued_spin_lock_slowpath+0x1a0/0x390
[ 111.795809] kthread_queue_work+0x30/0xc0
[ 111.799828] state_machine_timer_handler+0x20/0x30
[ 111.804624] __hrtimer_run_queues+0x140/0x1e0
[ 111.808990] hrtimer_interrupt+0xec/0x2c0
[ 111.813004] arch_timer_handler_phys+0x38/0x50
[ 111.817456] handle_percpu_devid_irq+0x88/0x150
[ 111.821991] __handle_domain_irq+0x80/0xe0
[ 111.826093] gic_handle_irq+0xc0/0x140
[ 111.829848] el1_irq+0xbc/0x154
[ 111.832991] arch_cpu_idle+0x1c/0x2c
[ 111.836572] default_idle_call+0x24/0x6c
[ 111.840497] do_idle+0x238/0x2ac
[ 1
---truncated---
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-12 15:24 UTC
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
3ed8e1c2ac9914a2fcb08ec13476b85319536cea , < 18eaf0de50eadeeb395b83310b259b21ad8ed0a6
(git)
Affected: 3ed8e1c2ac9914a2fcb08ec13476b85319536cea , < d0a06696a8a4d99f649240b6f9b8a2e55452ecf5 (git) Affected: 3ed8e1c2ac9914a2fcb08ec13476b85319536cea , < 3a13ff7ef4349d70d1d18378d661117dd5af8efe (git) |
guessed | |
| Linux | Linux |
Affected:
5.10
Unaffected: 0 , < 5.10 (semver) Unaffected: 5.10.44 , ≤ 5.10.* (semver) Unaffected: 5.12.11 , ≤ 5.12.* (semver) Unaffected: 5.13 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-47268",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-12T15:24:57.809869Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T15:25:08.195Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:32:07.939Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/18eaf0de50eadeeb395b83310b259b21ad8ed0a6"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/d0a06696a8a4d99f649240b6f9b8a2e55452ecf5"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/3a13ff7ef4349d70d1d18378d661117dd5af8efe"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/tcpm/tcpm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "18eaf0de50eadeeb395b83310b259b21ad8ed0a6",
"status": "affected",
"version": "3ed8e1c2ac9914a2fcb08ec13476b85319536cea",
"versionType": "git"
},
{
"lessThan": "d0a06696a8a4d99f649240b6f9b8a2e55452ecf5",
"status": "affected",
"version": "3ed8e1c2ac9914a2fcb08ec13476b85319536cea",
"versionType": "git"
},
{
"lessThan": "3a13ff7ef4349d70d1d18378d661117dd5af8efe",
"status": "affected",
"version": "3ed8e1c2ac9914a2fcb08ec13476b85319536cea",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/tcpm/tcpm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.12.*",
"status": "unaffected",
"version": "5.12.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.44",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.12.11",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.13",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port\n\nA pending hrtimer may expire after the kthread_worker of tcpm port\nis destroyed, see below kernel dump when do module unload, fix it\nby cancel the 2 hrtimers.\n\n[ 111.517018] Unable to handle kernel paging request at virtual address ffff8000118cb880\n[ 111.518786] blk_update_request: I/O error, dev sda, sector 60061185 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0\n[ 111.526594] Mem abort info:\n[ 111.526597] ESR = 0x96000047\n[ 111.526600] EC = 0x25: DABT (current EL), IL = 32 bits\n[ 111.526604] SET = 0, FnV = 0\n[ 111.526607] EA = 0, S1PTW = 0\n[ 111.526610] Data abort info:\n[ 111.526612] ISV = 0, ISS = 0x00000047\n[ 111.526615] CM = 0, WnR = 1\n[ 111.526619] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041d75000\n[ 111.526623] [ffff8000118cb880] pgd=10000001bffff003, p4d=10000001bffff003, pud=10000001bfffe003, pmd=10000001bfffa003, pte=0000000000000000\n[ 111.526642] Internal error: Oops: 96000047 [#1] PREEMPT SMP\n[ 111.526647] Modules linked in: dwc3_imx8mp dwc3 phy_fsl_imx8mq_usb [last unloaded: tcpci]\n[ 111.526663] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.13.0-rc4-00927-gebbe9dbd802c-dirty #36\n[ 111.526670] Hardware name: NXP i.MX8MPlus EVK board (DT)\n[ 111.526674] pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO BTYPE=--)\n[ 111.526681] pc : queued_spin_lock_slowpath+0x1a0/0x390\n[ 111.526695] lr : _raw_spin_lock_irqsave+0x88/0xb4\n[ 111.526703] sp : ffff800010003e20\n[ 111.526706] x29: ffff800010003e20 x28: ffff00017f380180\n[ 111.537156] buffer_io_error: 6 callbacks suppressed\n[ 111.537162] Buffer I/O error on dev sda1, logical block 60040704, async page read\n[ 111.539932] x27: ffff00017f3801c0\n[ 111.539938] x26: ffff800010ba2490 x25: 0000000000000000 x24: 0000000000000001\n[ 111.543025] blk_update_request: I/O error, dev sda, sector 60061186 op 0x0:(READ) flags 0x0 phys_seg 7 prio class 0\n[ 111.548304]\n[ 111.548306] x23: 00000000000000c0 x22: ffff0000c2a9f184 x21: ffff00017f380180\n[ 111.551374] Buffer I/O error on dev sda1, logical block 60040705, async page read\n[ 111.554499]\n[ 111.554503] x20: ffff0000c5f14210 x19: 00000000000000c0 x18: 0000000000000000\n[ 111.557391] Buffer I/O error on dev sda1, logical block 60040706, async page read\n[ 111.561218]\n[ 111.561222] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\n[ 111.564205] Buffer I/O error on dev sda1, logical block 60040707, async page read\n[ 111.570887] x14: 00000000000000f5 x13: 0000000000000001 x12: 0000000000000040\n[ 111.570902] x11: ffff0000c05ac6d8\n[ 111.583420] Buffer I/O error on dev sda1, logical block 60040708, async page read\n[ 111.588978] x10: 0000000000000000 x9 : 0000000000040000\n[ 111.588988] x8 : 0000000000000000\n[ 111.597173] Buffer I/O error on dev sda1, logical block 60040709, async page read\n[ 111.605766] x7 : ffff00017f384880 x6 : ffff8000118cb880\n[ 111.605777] x5 : ffff00017f384880\n[ 111.611094] Buffer I/O error on dev sda1, logical block 60040710, async page read\n[ 111.617086] x4 : 0000000000000000 x3 : ffff0000c2a9f184\n[ 111.617096] x2 : ffff8000118cb880\n[ 111.622242] Buffer I/O error on dev sda1, logical block 60040711, async page read\n[ 111.626927] x1 : ffff8000118cb880 x0 : ffff00017f384888\n[ 111.626938] Call trace:\n[ 111.626942] queued_spin_lock_slowpath+0x1a0/0x390\n[ 111.795809] kthread_queue_work+0x30/0xc0\n[ 111.799828] state_machine_timer_handler+0x20/0x30\n[ 111.804624] __hrtimer_run_queues+0x140/0x1e0\n[ 111.808990] hrtimer_interrupt+0xec/0x2c0\n[ 111.813004] arch_timer_handler_phys+0x38/0x50\n[ 111.817456] handle_percpu_devid_irq+0x88/0x150\n[ 111.821991] __handle_domain_irq+0x80/0xe0\n[ 111.826093] gic_handle_irq+0xc0/0x140\n[ 111.829848] el1_irq+0xbc/0x154\n[ 111.832991] arch_cpu_idle+0x1c/0x2c\n[ 111.836572] default_idle_call+0x24/0x6c\n[ 111.840497] do_idle+0x238/0x2ac\n[ 1\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T13:51:13.351Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/18eaf0de50eadeeb395b83310b259b21ad8ed0a6"
},
{
"url": "https://git.kernel.org/stable/c/d0a06696a8a4d99f649240b6f9b8a2e55452ecf5"
},
{
"url": "https://git.kernel.org/stable/c/3a13ff7ef4349d70d1d18378d661117dd5af8efe"
}
],
"title": "usb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2021-47268",
"datePublished": "2024-05-21T14:19:58.550Z",
"dateReserved": "2024-05-21T13:27:52.127Z",
"dateUpdated": "2026-05-11T13:51:13.351Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2021-47268",
"date": "2026-08-31",
"epss": "0.00231",
"percentile": "0.13753"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.10\", \"versionEndExcluding\": \"5.10.44\", \"matchCriteriaId\": \"C7E14A6C-41D9-41C0-88FA-8959D208A792\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.12.11\", \"matchCriteriaId\": \"F914A757-FAFD-407E-9031-21F66635D5EA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"96AC23B2-D46A-49D9-8203-8E1BEDCA8532\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"DA610E30-717C-4700-9F77-A3C9244F3BFD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"1ECD33F5-85BE-430B-8F86-8D7BD560311D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"CF351855-2437-4CF5-AD7C-BDFA51F27683\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port\\n\\nA pending hrtimer may expire after the kthread_worker of tcpm port\\nis destroyed, see below kernel dump when do module unload, fix it\\nby cancel the 2 hrtimers.\\n\\n[ 111.517018] Unable to handle kernel paging request at virtual address ffff8000118cb880\\n[ 111.518786] blk_update_request: I/O error, dev sda, sector 60061185 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0\\n[ 111.526594] Mem abort info:\\n[ 111.526597] ESR = 0x96000047\\n[ 111.526600] EC = 0x25: DABT (current EL), IL = 32 bits\\n[ 111.526604] SET = 0, FnV = 0\\n[ 111.526607] EA = 0, S1PTW = 0\\n[ 111.526610] Data abort info:\\n[ 111.526612] ISV = 0, ISS = 0x00000047\\n[ 111.526615] CM = 0, WnR = 1\\n[ 111.526619] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041d75000\\n[ 111.526623] [ffff8000118cb880] pgd=10000001bffff003, p4d=10000001bffff003, pud=10000001bfffe003, pmd=10000001bfffa003, pte=0000000000000000\\n[ 111.526642] Internal error: Oops: 96000047 [#1] PREEMPT SMP\\n[ 111.526647] Modules linked in: dwc3_imx8mp dwc3 phy_fsl_imx8mq_usb [last unloaded: tcpci]\\n[ 111.526663] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.13.0-rc4-00927-gebbe9dbd802c-dirty #36\\n[ 111.526670] Hardware name: NXP i.MX8MPlus EVK board (DT)\\n[ 111.526674] pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO BTYPE=--)\\n[ 111.526681] pc : queued_spin_lock_slowpath+0x1a0/0x390\\n[ 111.526695] lr : _raw_spin_lock_irqsave+0x88/0xb4\\n[ 111.526703] sp : ffff800010003e20\\n[ 111.526706] x29: ffff800010003e20 x28: ffff00017f380180\\n[ 111.537156] buffer_io_error: 6 callbacks suppressed\\n[ 111.537162] Buffer I/O error on dev sda1, logical block 60040704, async page read\\n[ 111.539932] x27: ffff00017f3801c0\\n[ 111.539938] x26: ffff800010ba2490 x25: 0000000000000000 x24: 0000000000000001\\n[ 111.543025] blk_update_request: I/O error, dev sda, sector 60061186 op 0x0:(READ) flags 0x0 phys_seg 7 prio class 0\\n[ 111.548304]\\n[ 111.548306] x23: 00000000000000c0 x22: ffff0000c2a9f184 x21: ffff00017f380180\\n[ 111.551374] Buffer I/O error on dev sda1, logical block 60040705, async page read\\n[ 111.554499]\\n[ 111.554503] x20: ffff0000c5f14210 x19: 00000000000000c0 x18: 0000000000000000\\n[ 111.557391] Buffer I/O error on dev sda1, logical block 60040706, async page read\\n[ 111.561218]\\n[ 111.561222] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\\n[ 111.564205] Buffer I/O error on dev sda1, logical block 60040707, async page read\\n[ 111.570887] x14: 00000000000000f5 x13: 0000000000000001 x12: 0000000000000040\\n[ 111.570902] x11: ffff0000c05ac6d8\\n[ 111.583420] Buffer I/O error on dev sda1, logical block 60040708, async page read\\n[ 111.588978] x10: 0000000000000000 x9 : 0000000000040000\\n[ 111.588988] x8 : 0000000000000000\\n[ 111.597173] Buffer I/O error on dev sda1, logical block 60040709, async page read\\n[ 111.605766] x7 : ffff00017f384880 x6 : ffff8000118cb880\\n[ 111.605777] x5 : ffff00017f384880\\n[ 111.611094] Buffer I/O error on dev sda1, logical block 60040710, async page read\\n[ 111.617086] x4 : 0000000000000000 x3 : ffff0000c2a9f184\\n[ 111.617096] x2 : ffff8000118cb880\\n[ 111.622242] Buffer I/O error on dev sda1, logical block 60040711, async page read\\n[ 111.626927] x1 : ffff8000118cb880 x0 : ffff00017f384888\\n[ 111.626938] Call trace:\\n[ 111.626942] queued_spin_lock_slowpath+0x1a0/0x390\\n[ 111.795809] kthread_queue_work+0x30/0xc0\\n[ 111.799828] state_machine_timer_handler+0x20/0x30\\n[ 111.804624] __hrtimer_run_queues+0x140/0x1e0\\n[ 111.808990] hrtimer_interrupt+0xec/0x2c0\\n[ 111.813004] arch_timer_handler_phys+0x38/0x50\\n[ 111.817456] handle_percpu_devid_irq+0x88/0x150\\n[ 111.821991] __handle_domain_irq+0x80/0xe0\\n[ 111.826093] gic_handle_irq+0xc0/0x140\\n[ 111.829848] el1_irq+0xbc/0x154\\n[ 111.832991] arch_cpu_idle+0x1c/0x2c\\n[ 111.836572] default_idle_call+0x24/0x6c\\n[ 111.840497] do_idle+0x238/0x2ac\\n[ 1\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: typec: tcpm: cancela vdm y state machine hrtimer cuando se cancela el registro del puerto tcpm. Un hrtimer pendiente puede caducar despu\\u00e9s de que se destruya el kthread_worker del puerto tcpm; consulte el siguiente volcado del kernel cuando se descarga el m\\u00f3dulo , solucionelo cancelando los 2 temporizadores. [ 111.517018] No se puede manejar la solicitud de paginaci\\u00f3n del kernel en la direcci\\u00f3n virtual ffff8000118cb880 [ 111.518786] blk_update_request: error de E/S, dev sda, sector 60061185 op 0x0:(LEER) indicadores 0x0 phys_seg 1 prio clase 0 [ 111.526594] Informaci\\u00f3n de cancelaci\\u00f3n de memoria: [111.526597 ] ESR = 0x96000047 [ 111.526600] EC = 0x25: DABT (EL actual), IL = 32 bits [ 111.526604] SET = 0, FnV = 0 [ 111.526607] EA = 0, S1PTW = 0 [ 111.526610] Informaci\\u00f3n de cancelaci\\u00f3n de datos: [ 111. 526612 ] ISV = 0, ISS = 0x00000047 [ 111.526615] CM = 0, WnR = 1 [ 111.526619] tabla de intercambio: p\\u00e1ginas de 4k, VA de 48 bits, pgdp=0000000041d75000 [ 111.526623 [ffff8000118cb] 880] pgd=10000001bffff003, p4d=10000001bffff003, pud\\u00edn =10000001bfffe003, pmd=10000001bfffa003, pte=0000000000000000 [111.526642] Error interno: Ups: 96000047 [#1] SMP PREEMPLEO [111.526647] M\\u00f3dulos vinculados en: dwc3_imx8mp dwc3 phy_fsl_imx8mq_usb [\\u00faltima descarga: tcpci] [111.526663] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.13.0-rc4-00927-gebbe9dbd802c-dirty #36 [111.526670] Nombre del hardware: placa NXP i.MX8MPlus EVK (DT) [111.526674] pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO BTYPE=--) [ 111.526681] pc : queued_spin_lock_slowpath+0x1a0/0x390 [ 111.526695] lr : _raw_spin_lock_irqsave+0x88/0xb4 [ 111.526703] sp : ffff800010003e20 [ 111.526 706] x29: ffff800010003e20 x28: ffff00017f380180 [111.537156] buffer_io_error: 6 devoluciones de llamada suprimidas [111.537162 ] Error de E/S del b\\u00fafer en dev sda1, bloque l\\u00f3gico 60040704, lectura de p\\u00e1gina as\\u00edncrona [111.539932] x27: ffff00017f3801c0 [111.539938] x26: ffff800010ba2490 x25: 0000000000000000 x24: 00000000000001 [111.543025] blk_update_request: error de E/S, dev sda, sector 60061186 op 0x0:(LEER) banderas 0x0 phys_seg 7 prio clase 0 [ 111.548304] [ 111.548306] x23: 00000000000000c0 x22: ffff0000c2a9f184 x21: ffff00017f380180 [ 111.551 374] Error de E/S del b\\u00fafer en dev sda1, bloque l\\u00f3gico 60040705, lectura de p\\u00e1gina as\\u00edncrona [111.554499] [111.554503] x20: ffff0000c5f14210 x19: 00000000000000c0 x18: 0000000000000000 [111.557391] Error de E/S del b\\u00fafer en dev sda1, bloque l\\u00f3gico 60040706, lectura de p\\u00e1gina as\\u00edncrona [111. 561218] [ 111.561222] x17: 0000000000000000 x16: 0000000000000000 x15: 00000000000000000 [ 111.564205] B\\u00fafer Error de E/S en dev sda1, bloque l\\u00f3gico 60040707, lectura de p\\u00e1gina as\\u00edncrona [111.570887] x14: 00000000000000f5 x13: 00000000000000001 x12: 0000000000000040 [111.570902] x11: ff0000c05ac6d8 [111.583420] Error de E/S del b\\u00fafer en dev sda1, bloque l\\u00f3gico 60040708, as\\u00edncrono lectura de p\\u00e1gina [111.588978] x10: 0000000000000000 x9: 0000000000040000 [111.588988] x8: 0000000000000000 [111.597173] Error de E/S del b\\u00fafer en dev sda1, bloque l\\u00f3gico 6004 0709, lectura de p\\u00e1gina as\\u00edncrona [111.605766] x7: ffff00017f384880 x6: ffff8000118cb880 [111.605777] x5: ffff00017f384880 [111.611094] Error de E/S del b\\u00fafer en dev sda1, bloque l\\u00f3gico 60040710, lectura de p\\u00e1gina as\\u00edncrona [111.617086] x4: 0000000000000000 x3: ffff0000c2a9f184 [111.617096] 2: ffff8000118cb880 [111.622242] Error de E/S del b\\u00fafer en dev sda1, bloque l\\u00f3gico 60040711 , lectura de p\\u00e1gina as\\u00edncrona [111.626927] x1: ffff8000118cb880 x0: ffff00017f384888 [111.626938] Seguimiento de llamadas: [111.626942] queued_spin_lock_slowpath+0x1a0/0x390 [111.795809] _queue_work+0x30/0xc0 [ 111.799828] state_machine_timer_handler+0x20/0x30 [ 111.804624] __hrtimer_run_queues+0x140/ 0x1e0 [ 111.808990] hrtimer_interrupt+0xec/0x2c0 [ 111.813004] arch_timer_handler_phys+0x38/0x50 [ 111.817456] handle_percpu_devid_irq+0x88/0x150 [ 111.821991] main_irq+0x80/0xe0 [ 111.826093] gic_handle_irq+0x ---truncado---\"}]",
"id": "CVE-2021-47268",
"lastModified": "2024-12-26T20:42:00.700",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
"published": "2024-05-21T15:15:15.390",
"references": "[{\"url\": \"https://git.kernel.org/stable/c/18eaf0de50eadeeb395b83310b259b21ad8ed0a6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3a13ff7ef4349d70d1d18378d661117dd5af8efe\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d0a06696a8a4d99f649240b6f9b8a2e55452ecf5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/18eaf0de50eadeeb395b83310b259b21ad8ed0a6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3a13ff7ef4349d70d1d18378d661117dd5af8efe\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d0a06696a8a4d99f649240b6f9b8a2e55452ecf5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Analyzed",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2021-47268\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T15:15:15.390\",\"lastModified\":\"2026-06-17T04:17:03.503\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port\\n\\nA pending hrtimer may expire after the kthread_worker of tcpm port\\nis destroyed, see below kernel dump when do module unload, fix it\\nby cancel the 2 hrtimers.\\n\\n[ 111.517018] Unable to handle kernel paging request at virtual address ffff8000118cb880\\n[ 111.518786] blk_update_request: I/O error, dev sda, sector 60061185 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0\\n[ 111.526594] Mem abort info:\\n[ 111.526597] ESR = 0x96000047\\n[ 111.526600] EC = 0x25: DABT (current EL), IL = 32 bits\\n[ 111.526604] SET = 0, FnV = 0\\n[ 111.526607] EA = 0, S1PTW = 0\\n[ 111.526610] Data abort info:\\n[ 111.526612] ISV = 0, ISS = 0x00000047\\n[ 111.526615] CM = 0, WnR = 1\\n[ 111.526619] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041d75000\\n[ 111.526623] [ffff8000118cb880] pgd=10000001bffff003, p4d=10000001bffff003, pud=10000001bfffe003, pmd=10000001bfffa003, pte=0000000000000000\\n[ 111.526642] Internal error: Oops: 96000047 [#1] PREEMPT SMP\\n[ 111.526647] Modules linked in: dwc3_imx8mp dwc3 phy_fsl_imx8mq_usb [last unloaded: tcpci]\\n[ 111.526663] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.13.0-rc4-00927-gebbe9dbd802c-dirty #36\\n[ 111.526670] Hardware name: NXP i.MX8MPlus EVK board (DT)\\n[ 111.526674] pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO BTYPE=--)\\n[ 111.526681] pc : queued_spin_lock_slowpath+0x1a0/0x390\\n[ 111.526695] lr : _raw_spin_lock_irqsave+0x88/0xb4\\n[ 111.526703] sp : ffff800010003e20\\n[ 111.526706] x29: ffff800010003e20 x28: ffff00017f380180\\n[ 111.537156] buffer_io_error: 6 callbacks suppressed\\n[ 111.537162] Buffer I/O error on dev sda1, logical block 60040704, async page read\\n[ 111.539932] x27: ffff00017f3801c0\\n[ 111.539938] x26: ffff800010ba2490 x25: 0000000000000000 x24: 0000000000000001\\n[ 111.543025] blk_update_request: I/O error, dev sda, sector 60061186 op 0x0:(READ) flags 0x0 phys_seg 7 prio class 0\\n[ 111.548304]\\n[ 111.548306] x23: 00000000000000c0 x22: ffff0000c2a9f184 x21: ffff00017f380180\\n[ 111.551374] Buffer I/O error on dev sda1, logical block 60040705, async page read\\n[ 111.554499]\\n[ 111.554503] x20: ffff0000c5f14210 x19: 00000000000000c0 x18: 0000000000000000\\n[ 111.557391] Buffer I/O error on dev sda1, logical block 60040706, async page read\\n[ 111.561218]\\n[ 111.561222] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\\n[ 111.564205] Buffer I/O error on dev sda1, logical block 60040707, async page read\\n[ 111.570887] x14: 00000000000000f5 x13: 0000000000000001 x12: 0000000000000040\\n[ 111.570902] x11: ffff0000c05ac6d8\\n[ 111.583420] Buffer I/O error on dev sda1, logical block 60040708, async page read\\n[ 111.588978] x10: 0000000000000000 x9 : 0000000000040000\\n[ 111.588988] x8 : 0000000000000000\\n[ 111.597173] Buffer I/O error on dev sda1, logical block 60040709, async page read\\n[ 111.605766] x7 : ffff00017f384880 x6 : ffff8000118cb880\\n[ 111.605777] x5 : ffff00017f384880\\n[ 111.611094] Buffer I/O error on dev sda1, logical block 60040710, async page read\\n[ 111.617086] x4 : 0000000000000000 x3 : ffff0000c2a9f184\\n[ 111.617096] x2 : ffff8000118cb880\\n[ 111.622242] Buffer I/O error on dev sda1, logical block 60040711, async page read\\n[ 111.626927] x1 : ffff8000118cb880 x0 : ffff00017f384888\\n[ 111.626938] Call trace:\\n[ 111.626942] queued_spin_lock_slowpath+0x1a0/0x390\\n[ 111.795809] kthread_queue_work+0x30/0xc0\\n[ 111.799828] state_machine_timer_handler+0x20/0x30\\n[ 111.804624] __hrtimer_run_queues+0x140/0x1e0\\n[ 111.808990] hrtimer_interrupt+0xec/0x2c0\\n[ 111.813004] arch_timer_handler_phys+0x38/0x50\\n[ 111.817456] handle_percpu_devid_irq+0x88/0x150\\n[ 111.821991] __handle_domain_irq+0x80/0xe0\\n[ 111.826093] gic_handle_irq+0xc0/0x140\\n[ 111.829848] el1_irq+0xbc/0x154\\n[ 111.832991] arch_cpu_idle+0x1c/0x2c\\n[ 111.836572] default_idle_call+0x24/0x6c\\n[ 111.840497] do_idle+0x238/0x2ac\\n[ 1\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: typec: tcpm: cancela vdm y state machine hrtimer cuando se cancela el registro del puerto tcpm. Un hrtimer pendiente puede caducar despu\u00e9s de que se destruya el kthread_worker del puerto tcpm; consulte el siguiente volcado del kernel cuando se descarga el m\u00f3dulo , solucionelo cancelando los 2 temporizadores. [ 111.517018] No se puede manejar la solicitud de paginaci\u00f3n del kernel en la direcci\u00f3n virtual ffff8000118cb880 [ 111.518786] blk_update_request: error de E/S, dev sda, sector 60061185 op 0x0:(LEER) indicadores 0x0 phys_seg 1 prio clase 0 [ 111.526594] Informaci\u00f3n de cancelaci\u00f3n de memoria: [111.526597 ] ESR = 0x96000047 [ 111.526600] EC = 0x25: DABT (EL actual), IL = 32 bits [ 111.526604] SET = 0, FnV = 0 [ 111.526607] EA = 0, S1PTW = 0 [ 111.526610] Informaci\u00f3n de cancelaci\u00f3n de datos: [ 111. 526612 ] ISV = 0, ISS = 0x00000047 [ 111.526615] CM = 0, WnR = 1 [ 111.526619] tabla de intercambio: p\u00e1ginas de 4k, VA de 48 bits, pgdp=0000000041d75000 [ 111.526623 [ffff8000118cb] 880] pgd=10000001bffff003, p4d=10000001bffff003, pud\u00edn =10000001bfffe003, pmd=10000001bfffa003, pte=0000000000000000 [111.526642] Error interno: Ups: 96000047 [#1] SMP PREEMPLEO [111.526647] M\u00f3dulos vinculados en: dwc3_imx8mp dwc3 phy_fsl_imx8mq_usb [\u00faltima descarga: tcpci] [111.526663] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.13.0-rc4-00927-gebbe9dbd802c-dirty #36 [111.526670] Nombre del hardware: placa NXP i.MX8MPlus EVK (DT) [111.526674] pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO BTYPE=--) [ 111.526681] pc : queued_spin_lock_slowpath+0x1a0/0x390 [ 111.526695] lr : _raw_spin_lock_irqsave+0x88/0xb4 [ 111.526703] sp : ffff800010003e20 [ 111.526 706] x29: ffff800010003e20 x28: ffff00017f380180 [111.537156] buffer_io_error: 6 devoluciones de llamada suprimidas [111.537162 ] Error de E/S del b\u00fafer en dev sda1, bloque l\u00f3gico 60040704, lectura de p\u00e1gina as\u00edncrona [111.539932] x27: ffff00017f3801c0 [111.539938] x26: ffff800010ba2490 x25: 0000000000000000 x24: 00000000000001 [111.543025] blk_update_request: error de E/S, dev sda, sector 60061186 op 0x0:(LEER) banderas 0x0 phys_seg 7 prio clase 0 [ 111.548304] [ 111.548306] x23: 00000000000000c0 x22: ffff0000c2a9f184 x21: ffff00017f380180 [ 111.551 374] Error de E/S del b\u00fafer en dev sda1, bloque l\u00f3gico 60040705, lectura de p\u00e1gina as\u00edncrona [111.554499] [111.554503] x20: ffff0000c5f14210 x19: 00000000000000c0 x18: 0000000000000000 [111.557391] Error de E/S del b\u00fafer en dev sda1, bloque l\u00f3gico 60040706, lectura de p\u00e1gina as\u00edncrona [111. 561218] [ 111.561222] x17: 0000000000000000 x16: 0000000000000000 x15: 00000000000000000 [ 111.564205] B\u00fafer Error de E/S en dev sda1, bloque l\u00f3gico 60040707, lectura de p\u00e1gina as\u00edncrona [111.570887] x14: 00000000000000f5 x13: 00000000000000001 x12: 0000000000000040 [111.570902] x11: ff0000c05ac6d8 [111.583420] Error de E/S del b\u00fafer en dev sda1, bloque l\u00f3gico 60040708, as\u00edncrono lectura de p\u00e1gina [111.588978] x10: 0000000000000000 x9: 0000000000040000 [111.588988] x8: 0000000000000000 [111.597173] Error de E/S del b\u00fafer en dev sda1, bloque l\u00f3gico 6004 0709, lectura de p\u00e1gina as\u00edncrona [111.605766] x7: ffff00017f384880 x6: ffff8000118cb880 [111.605777] x5: ffff00017f384880 [111.611094] Error de E/S del b\u00fafer en dev sda1, bloque l\u00f3gico 60040710, lectura de p\u00e1gina as\u00edncrona [111.617086] x4: 0000000000000000 x3: ffff0000c2a9f184 [111.617096] 2: ffff8000118cb880 [111.622242] Error de E/S del b\u00fafer en dev sda1, bloque l\u00f3gico 60040711 , lectura de p\u00e1gina as\u00edncrona [111.626927] x1: ffff8000118cb880 x0: ffff00017f384888 [111.626938] Seguimiento de llamadas: [111.626942] queued_spin_lock_slowpath+0x1a0/0x390 [111.795809] _queue_work+0x30/0xc0 [ 111.799828] state_machine_timer_handler+0x20/0x30 [ 111.804624] __hrtimer_run_queues+0x140/ 0x1e0 [ 111.808990] hrtimer_interrupt+0xec/0x2c0 [ 111.813004] arch_timer_handler_phys+0x38/0x50 [ 111.817456] handle_percpu_devid_irq+0x88/0x150 [ 111.821991] main_irq+0x80/0xe0 [ 111.826093] gic_handle_irq+0x ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/typec/tcpm/tcpm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3ed8e1c2ac9914a2fcb08ec13476b85319536cea\",\"lessThan\":\"18eaf0de50eadeeb395b83310b259b21ad8ed0a6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3ed8e1c2ac9914a2fcb08ec13476b85319536cea\",\"lessThan\":\"d0a06696a8a4d99f649240b6f9b8a2e55452ecf5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3ed8e1c2ac9914a2fcb08ec13476b85319536cea\",\"lessThan\":\"3a13ff7ef4349d70d1d18378d661117dd5af8efe\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/typec/tcpm/tcpm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.44\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.12.11\",\"lessThanOrEqual\":\"5.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-12T15:24:57.809869Z\",\"id\":\"CVE-2021-47268\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10\",\"versionEndExcluding\":\"5.10.44\",\"matchCriteriaId\":\"C7E14A6C-41D9-41C0-88FA-8959D208A792\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.12.11\",\"matchCriteriaId\":\"F914A757-FAFD-407E-9031-21F66635D5EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"96AC23B2-D46A-49D9-8203-8E1BEDCA8532\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA610E30-717C-4700-9F77-A3C9244F3BFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1ECD33F5-85BE-430B-8F86-8D7BD560311D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF351855-2437-4CF5-AD7C-BDFA51F27683\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/18eaf0de50eadeeb395b83310b259b21ad8ed0a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3a13ff7ef4349d70d1d18378d661117dd5af8efe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d0a06696a8a4d99f649240b6f9b8a2e55452ecf5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/18eaf0de50eadeeb395b83310b259b21ad8ed0a6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3a13ff7ef4349d70d1d18378d661117dd5af8efe\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d0a06696a8a4d99f649240b6f9b8a2e55452ecf5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2025-11-21T11:32:02+00:00",
"cve": "CVE-2021-47268",
"id": "CVE-2021-47268",
"initial_release_date": "2021-01-01T00:00:00+00:00",
"product_status:known_not_affected": "198",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: usb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47268.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-07-23T02:39:12Z",
"cve": "CVE-2021-47268",
"id": "CVE-2021-47268",
"initial_release_date": "2024-05-23T03:05:11Z",
"product_status:known_not_affected": "330",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2021-47268",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47268.json",
"version": "18"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/18eaf0de50eadeeb395b83310b259b21ad8ed0a6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d0a06696a8a4d99f649240b6f9b8a2e55452ecf5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3a13ff7ef4349d70d1d18378d661117dd5af8efe\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:07.939Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47268\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-12T15:24:57.809869Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-12T15:25:03.197Z\"}}], \"cna\": {\"title\": \"usb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3ed8e1c2ac9914a2fcb08ec13476b85319536cea\", \"lessThan\": \"18eaf0de50eadeeb395b83310b259b21ad8ed0a6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3ed8e1c2ac9914a2fcb08ec13476b85319536cea\", \"lessThan\": \"d0a06696a8a4d99f649240b6f9b8a2e55452ecf5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3ed8e1c2ac9914a2fcb08ec13476b85319536cea\", \"lessThan\": \"3a13ff7ef4349d70d1d18378d661117dd5af8efe\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/usb/typec/tcpm/tcpm.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.44\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/usb/typec/tcpm/tcpm.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/18eaf0de50eadeeb395b83310b259b21ad8ed0a6\"}, {\"url\": \"https://git.kernel.org/stable/c/d0a06696a8a4d99f649240b6f9b8a2e55452ecf5\"}, {\"url\": \"https://git.kernel.org/stable/c/3a13ff7ef4349d70d1d18378d661117dd5af8efe\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port\\n\\nA pending hrtimer may expire after the kthread_worker of tcpm port\\nis destroyed, see below kernel dump when do module unload, fix it\\nby cancel the 2 hrtimers.\\n\\n[ 111.517018] Unable to handle kernel paging request at virtual address ffff8000118cb880\\n[ 111.518786] blk_update_request: I/O error, dev sda, sector 60061185 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0\\n[ 111.526594] Mem abort info:\\n[ 111.526597] ESR = 0x96000047\\n[ 111.526600] EC = 0x25: DABT (current EL), IL = 32 bits\\n[ 111.526604] SET = 0, FnV = 0\\n[ 111.526607] EA = 0, S1PTW = 0\\n[ 111.526610] Data abort info:\\n[ 111.526612] ISV = 0, ISS = 0x00000047\\n[ 111.526615] CM = 0, WnR = 1\\n[ 111.526619] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041d75000\\n[ 111.526623] [ffff8000118cb880] pgd=10000001bffff003, p4d=10000001bffff003, pud=10000001bfffe003, pmd=10000001bfffa003, pte=0000000000000000\\n[ 111.526642] Internal error: Oops: 96000047 [#1] PREEMPT SMP\\n[ 111.526647] Modules linked in: dwc3_imx8mp dwc3 phy_fsl_imx8mq_usb [last unloaded: tcpci]\\n[ 111.526663] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.13.0-rc4-00927-gebbe9dbd802c-dirty #36\\n[ 111.526670] Hardware name: NXP i.MX8MPlus EVK board (DT)\\n[ 111.526674] pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO BTYPE=--)\\n[ 111.526681] pc : queued_spin_lock_slowpath+0x1a0/0x390\\n[ 111.526695] lr : _raw_spin_lock_irqsave+0x88/0xb4\\n[ 111.526703] sp : ffff800010003e20\\n[ 111.526706] x29: ffff800010003e20 x28: ffff00017f380180\\n[ 111.537156] buffer_io_error: 6 callbacks suppressed\\n[ 111.537162] Buffer I/O error on dev sda1, logical block 60040704, async page read\\n[ 111.539932] x27: ffff00017f3801c0\\n[ 111.539938] x26: ffff800010ba2490 x25: 0000000000000000 x24: 0000000000000001\\n[ 111.543025] blk_update_request: I/O error, dev sda, sector 60061186 op 0x0:(READ) flags 0x0 phys_seg 7 prio class 0\\n[ 111.548304]\\n[ 111.548306] x23: 00000000000000c0 x22: ffff0000c2a9f184 x21: ffff00017f380180\\n[ 111.551374] Buffer I/O error on dev sda1, logical block 60040705, async page read\\n[ 111.554499]\\n[ 111.554503] x20: ffff0000c5f14210 x19: 00000000000000c0 x18: 0000000000000000\\n[ 111.557391] Buffer I/O error on dev sda1, logical block 60040706, async page read\\n[ 111.561218]\\n[ 111.561222] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\\n[ 111.564205] Buffer I/O error on dev sda1, logical block 60040707, async page read\\n[ 111.570887] x14: 00000000000000f5 x13: 0000000000000001 x12: 0000000000000040\\n[ 111.570902] x11: ffff0000c05ac6d8\\n[ 111.583420] Buffer I/O error on dev sda1, logical block 60040708, async page read\\n[ 111.588978] x10: 0000000000000000 x9 : 0000000000040000\\n[ 111.588988] x8 : 0000000000000000\\n[ 111.597173] Buffer I/O error on dev sda1, logical block 60040709, async page read\\n[ 111.605766] x7 : ffff00017f384880 x6 : ffff8000118cb880\\n[ 111.605777] x5 : ffff00017f384880\\n[ 111.611094] Buffer I/O error on dev sda1, logical block 60040710, async page read\\n[ 111.617086] x4 : 0000000000000000 x3 : ffff0000c2a9f184\\n[ 111.617096] x2 : ffff8000118cb880\\n[ 111.622242] Buffer I/O error on dev sda1, logical block 60040711, async page read\\n[ 111.626927] x1 : ffff8000118cb880 x0 : ffff00017f384888\\n[ 111.626938] Call trace:\\n[ 111.626942] queued_spin_lock_slowpath+0x1a0/0x390\\n[ 111.795809] kthread_queue_work+0x30/0xc0\\n[ 111.799828] state_machine_timer_handler+0x20/0x30\\n[ 111.804624] __hrtimer_run_queues+0x140/0x1e0\\n[ 111.808990] hrtimer_interrupt+0xec/0x2c0\\n[ 111.813004] arch_timer_handler_phys+0x38/0x50\\n[ 111.817456] handle_percpu_devid_irq+0x88/0x150\\n[ 111.821991] __handle_domain_irq+0x80/0xe0\\n[ 111.826093] gic_handle_irq+0xc0/0x140\\n[ 111.829848] el1_irq+0xbc/0x154\\n[ 111.832991] arch_cpu_idle+0x1c/0x2c\\n[ 111.836572] default_idle_call+0x24/0x6c\\n[ 111.840497] do_idle+0x238/0x2ac\\n[ 1\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.44\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.11\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13\", \"versionStartIncluding\": \"5.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T07:07:34.783Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2021-47268\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T07:07:34.783Z\", \"dateReserved\": \"2024-05-21T13:27:52.127Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T14:19:58.550Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…