CVE-2021-46939— tracing: Restructure trace_clock_global() to never block
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于重构trace_clock_global()以永不阻塞。
Possible ATT&CK Techniques 1 AI
T1053 · Scheduled Task/JobAffected Version Matrix 20
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 14131f2f98ac350ee9e73faed916d2238a8b6a0d< 91ca6f6a91f679c8645d7f3307e03ce86ad518c4 |
affected |
14131f2f98ac350ee9e73faed916d2238a8b6a0d< 859b47a43f5a0e5b9a92b621dc6ceaad39fb5c8b |
affected | ||
14131f2f98ac350ee9e73faed916d2238a8b6a0d< 1fca00920327be96f3318224f502e4d5460f9545 |
affected | ||
14131f2f98ac350ee9e73faed916d2238a8b6a0d< d43d56dbf452ccecc1ec735cd4b6840118005d7c |
affected | ||
14131f2f98ac350ee9e73faed916d2238a8b6a0d< c64da3294a7d59a4bf6874c664c13be892f15f44 |
affected | ||
14131f2f98ac350ee9e73faed916d2238a8b6a0d< a33614d52e97fc8077eb0b292189ca7d964cc534 |
affected | ||
14131f2f98ac350ee9e73faed916d2238a8b6a0d< 6e2418576228eeb12e7ba82edb8f9500623942ff |
affected | ||
14131f2f98ac350ee9e73faed916d2238a8b6a0d< 2a1bd74b8186d7938bf004f5603f25b84785f63e |
affected | ||
| … +12 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-46939
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
tracing: Restructure trace_clock_global() to never block
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
tracing: Restructure trace_clock_global() to never block
It was reported that a fix to the ring buffer recursion detection would
cause a hung machine when performing suspend / resume testing. The
following backtrace was extracted from debugging that case:
Call Trace:
trace_clock_global+0x91/0xa0
__rb_reserve_next+0x237/0x460
ring_buffer_lock_reserve+0x12a/0x3f0
trace_buffer_lock_reserve+0x10/0x50
__trace_graph_return+0x1f/0x80
trace_graph_return+0xb7/0xf0
? trace_clock_global+0x91/0xa0
ftrace_return_to_handler+0x8b/0xf0
? pv_hash+0xa0/0xa0
return_to_handler+0x15/0x30
? ftrace_graph_caller+0xa0/0xa0
? trace_clock_global+0x91/0xa0
? __rb_reserve_next+0x237/0x460
? ring_buffer_lock_reserve+0x12a/0x3f0
? trace_event_buffer_lock_reserve+0x3c/0x120
? trace_event_buffer_reserve+0x6b/0xc0
? trace_event_raw_event_device_pm_callback_start+0x125/0x2d0
? dpm_run_callback+0x3b/0xc0
? pm_ops_is_empty+0x50/0x50
? platform_get_irq_byname_optional+0x90/0x90
? trace_device_pm_callback_start+0x82/0xd0
? dpm_run_callback+0x49/0xc0
With the following RIP:
RIP: 0010:native_queued_spin_lock_slowpath+0x69/0x200
Since the fix to the recursion detection would allow a single recursion to
happen while tracing, this lead to the trace_clock_global() taking a spin
lock and then trying to take it again:
ring_buffer_lock_reserve() {
trace_clock_global() {
arch_spin_lock() {
queued_spin_lock_slowpath() {
/* lock taken */
(something else gets traced by function graph tracer)
ring_buffer_lock_reserve() {
trace_clock_global() {
arch_spin_lock() {
queued_spin_lock_slowpath() {
/* DEAD LOCK! */
Tracing should *never* block, as it can lead to strange lockups like the
above.
Restructure the trace_clock_global() code to instead of simply taking a
lock to update the recorded "prev_time" simply use it, as two events
happening on two different CPUs that calls this at the same time, really
doesn't matter which one goes first. Use a trylock to grab the lock for
updating the prev_time, and if it fails, simply try again the next time.
If it failed to be taken, that means something else is already updating
it.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=212761
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于重构trace_clock_global()以永不阻塞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-46939
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-46939
请登录查看更多情报信息。
Patches & Fixes for CVE-2021-46939 (1)
Other References for CVE-2021-46939 (7)
Same Patch Batch · Linux · 2024-02-27 · 67 CVEs total
| CVE-2021-46911 | 9.8 CRITICAL | ch_ktls: Fix kernel panic |
| CVE-2021-46955 | 8.2 HIGH | openvswitch: fix stack OOB read while fragmenting IPv4 packets |
| CVE-2021-46963 | 7.8 HIGH | scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand() |
| CVE-2021-46925 | 7.8 HIGH | net/smc: fix kernel panic caused by race of smc_sock |
| CVE-2021-46929 | 7.8 HIGH | sctp: use call_rcu to free endpoint |
| CVE-2021-46913 | 7.8 HIGH | netfilter: nftables: clone set element expression template |
| CVE-2021-46973 | 7.8 HIGH | net: qrtr: Avoid potential use after free in MHI send |
| CVE-2021-46936 | 7.8 HIGH | net: fix use-after-free in tw_timer_handler |
| CVE-2021-46933 | 7.8 HIGH | usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. |
| CVE-2021-46969 | 7.8 HIGH | bus: mhi: core: Fix invalid error returning in mhi_queue |
| CVE-2021-46958 | 7.8 HIGH | btrfs: fix race between transaction aborts and fsyncs leading to use-after-free |
| CVE-2021-46967 | 7.8 HIGH | vhost-vdpa: fix vm_flags for virtqueue doorbell mapping |
| CVE-2021-46921 | 7.8 HIGH | locking/qrwlock: Fix ordering in queued_write_lock_slowpath() |
| CVE-2021-46922 | 7.8 HIGH | KEYS: trusted: Fix TPM reservation for seal/unseal |
| CVE-2021-46948 | 7.5 HIGH | sfc: farch: fix TX queue lookup in TX event handling |
| CVE-2021-46960 | 7.5 HIGH | cifs: Return correct error code from smb2_get_enc_key |
| CVE-2021-46912 | 7.3 HIGH | net: Make tcp_allowed_congestion_control readonly in non-init netns |
| CVE-2021-46908 | 7.1 HIGH | bpf: Use correct permission flag for mixed signed bounds arithmetic |
| CVE-2021-46974 | 7.1 HIGH | bpf: Fix masking negation logic upon negative dst register |
| CVE-2021-46910 | 7.0 HIGH | ARM: 9063/1: mm: reduce maximum number of CPUs if DEBUG_KMAP_LOCAL is enabled |
Showing top 20 of 67 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
Same vendor: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
V. Comments for CVE-2021-46939
No comments yet