CVE-2021-46964— scsi: qla2xxx: Reserve extra IRQ vectors
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于保留额外的IRQ向量。
Possible ATT&CK Techniques 1 AI
T1496 · Resource HijackingAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | a6dcfe08487e5e83b6b4214c959a9577a9ed2d9f< 4ecd42dec858b6632c5f024fe13e9ad6c30f2734 |
affected |
a6dcfe08487e5e83b6b4214c959a9577a9ed2d9f< 0f86d66b38501e3ac66cf2d9f9f8ad6838bad0e6 |
affected | ||
a6dcfe08487e5e83b6b4214c959a9577a9ed2d9f< f02d4086a8f36a0e1aaebf559b54cf24a177a486 |
affected | ||
5.11 |
affected | ||
< 5.11 |
unaffected | ||
5.11.20≤ 5.11.* |
unaffected | ||
5.12.3≤ 5.12.* |
unaffected | ||
5.13≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-46964
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
scsi: qla2xxx: Reserve extra IRQ vectors
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Reserve extra IRQ vectors
Commit a6dcfe08487e ("scsi: qla2xxx: Limit interrupt vectors to number of
CPUs") lowers the number of allocated MSI-X vectors to the number of CPUs.
That breaks vector allocation assumptions in qla83xx_iospace_config(),
qla24xx_enable_msix() and qla2x00_iospace_config(). Either of the functions
computes maximum number of qpairs as:
ha->max_qpairs = ha->msix_count - 1 (MB interrupt) - 1 (default
response queue) - 1 (ATIO, in dual or pure target mode)
max_qpairs is set to zero in case of two CPUs and initiator mode. The
number is then used to allocate ha->queue_pair_map inside
qla2x00_alloc_queues(). No allocation happens and ha->queue_pair_map is
left NULL but the driver thinks there are queue pairs available.
qla2xxx_queuecommand() tries to find a qpair in the map and crashes:
if (ha->mqenable) {
uint32_t tag;
uint16_t hwq;
struct qla_qpair *qpair = NULL;
tag = blk_mq_unique_tag(cmd->request);
hwq = blk_mq_unique_tag_to_hwq(tag);
qpair = ha->queue_pair_map[hwq]; # <- HERE
if (qpair)
return qla2xxx_mqueuecommand(host, cmd, qpair);
}
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] SMP PTI
CPU: 0 PID: 72 Comm: kworker/u4:3 Tainted: G W 5.10.0-rc1+ #25
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014
Workqueue: scsi_wq_7 fc_scsi_scan_rport [scsi_transport_fc]
RIP: 0010:qla2xxx_queuecommand+0x16b/0x3f0 [qla2xxx]
Call Trace:
scsi_queue_rq+0x58c/0xa60
blk_mq_dispatch_rq_list+0x2b7/0x6f0
? __sbitmap_get_word+0x2a/0x80
__blk_mq_sched_dispatch_requests+0xb8/0x170
blk_mq_sched_dispatch_requests+0x2b/0x50
__blk_mq_run_hw_queue+0x49/0xb0
__blk_mq_delay_run_hw_queue+0xfb/0x150
blk_mq_sched_insert_request+0xbe/0x110
blk_execute_rq+0x45/0x70
__scsi_execute+0x10e/0x250
scsi_probe_and_add_lun+0x228/0xda0
__scsi_scan_target+0xf4/0x620
? __pm_runtime_resume+0x4f/0x70
scsi_scan_target+0x100/0x110
fc_scsi_scan_rport+0xa1/0xb0 [scsi_transport_fc]
process_one_work+0x1ea/0x3b0
worker_thread+0x28/0x3b0
? process_one_work+0x3b0/0x3b0
kthread+0x112/0x130
? kthread_park+0x80/0x80
ret_from_fork+0x22/0x30
The driver should allocate enough vectors to provide every CPU it's own HW
queue and still handle reserved (MB, RSP, ATIO) interrupts.
The change fixes the crash on dual core VM and prevents unbalanced QP
allocation where nr_hw_queues is two less than the number of CPUs.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于保留额外的IRQ向量。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-46964
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-46964
请登录查看更多情报信息。
Other References for CVE-2021-46964 (1)
Same Patch Batch · Linux · 2024-02-27 · 67 CVEs total
| CVE-2021-46911 | 9.8 CRITICAL | ch_ktls: Fix kernel panic |
| CVE-2021-46955 | 8.2 HIGH | openvswitch: fix stack OOB read while fragmenting IPv4 packets |
| CVE-2021-46936 | 7.8 HIGH | net: fix use-after-free in tw_timer_handler |
| CVE-2021-46973 | 7.8 HIGH | net: qrtr: Avoid potential use after free in MHI send |
| CVE-2021-46913 | 7.8 HIGH | netfilter: nftables: clone set element expression template |
| CVE-2021-46969 | 7.8 HIGH | bus: mhi: core: Fix invalid error returning in mhi_queue |
| CVE-2021-46967 | 7.8 HIGH | vhost-vdpa: fix vm_flags for virtqueue doorbell mapping |
| CVE-2021-46921 | 7.8 HIGH | locking/qrwlock: Fix ordering in queued_write_lock_slowpath() |
| CVE-2021-46925 | 7.8 HIGH | net/smc: fix kernel panic caused by race of smc_sock |
| CVE-2021-46963 | 7.8 HIGH | scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand() |
| CVE-2021-46929 | 7.8 HIGH | sctp: use call_rcu to free endpoint |
| CVE-2021-46958 | 7.8 HIGH | btrfs: fix race between transaction aborts and fsyncs leading to use-after-free |
| CVE-2021-46933 | 7.8 HIGH | usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. |
| CVE-2021-46922 | 7.8 HIGH | KEYS: trusted: Fix TPM reservation for seal/unseal |
| CVE-2021-46948 | 7.5 HIGH | sfc: farch: fix TX queue lookup in TX event handling |
| CVE-2021-46960 | 7.5 HIGH | cifs: Return correct error code from smb2_get_enc_key |
| CVE-2021-46912 | 7.3 HIGH | net: Make tcp_allowed_congestion_control readonly in non-init netns |
| CVE-2021-46974 | 7.1 HIGH | bpf: Fix masking negation logic upon negative dst register |
| CVE-2021-46908 | 7.1 HIGH | bpf: Use correct permission flag for mixed signed bounds arithmetic |
| CVE-2021-46910 | 7.0 HIGH | ARM: 9063/1: mm: reduce maximum number of CPUs if DEBUG_KMAP_LOCAL is enabled |
Showing top 20 of 67 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
Same vendor: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
V. Comments for CVE-2021-46964
No comments yet