CVE-2021-47124— io_uring: fix link timeout refs
Possible ATT&CK Techniques 1AI
T1068 · Exploitation for Privilege EscalationAffected Version Matrix 16
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 1c20e9040f49687ba2ccc2ffd4411351a6c2ebff< 0b2a990e5d2f76d020cb840c456e6ec5f0c27530 | affected |
1c20e9040f49687ba2ccc2ffd4411351a6c2ebff< 6f5d7a45f58d3abe3a936de1441b8d6318f978ff | affected | ||
9ae1f8dd372e0e4c020b345cf9e09f519265e981< 876808dba2ff7509bdd7f230c4f374a0caf4f410 | affected | ||
9ae1f8dd372e0e4c020b345cf9e09f519265e981< ff4a96ba5c8f9b266706280ff8021d2ef3f17e86 | affected | ||
9ae1f8dd372e0e4c020b345cf9e09f519265e981< a298232ee6b9a1d5d732aa497ff8be0d45b5bd82 | affected | ||
567c81912cec641db75ac6cb64c63f8367c97d19 | affected | ||
5.10.26< 5.10.43 | affected | ||
5.10.26< 5.10.55 | affected | ||
| … +8 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-47124
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
io_uring: fix link timeout refs
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix link timeout refs WARNING: CPU: 0 PID: 10242 at lib/refcount.c:28 refcount_warn_saturate+0x15b/0x1a0 lib/refcount.c:28 RIP: 0010:refcount_warn_saturate+0x15b/0x1a0 lib/refcount.c:28 Call Trace: __refcount_sub_and_test include/linux/refcount.h:283 [inline] __refcount_dec_and_test include/linux/refcount.h:315 [inline] refcount_dec_and_test include/linux/refcount.h:333 [inline] io_put_req fs/io_uring.c:2140 [inline] io_queue_linked_timeout fs/io_uring.c:6300 [inline] __io_queue_sqe+0xbef/0xec0 fs/io_uring.c:6354 io_submit_sqe fs/io_uring.c:6534 [inline] io_submit_sqes+0x2bbd/0x7c50 fs/io_uring.c:6660 __do_sys_io_uring_enter fs/io_uring.c:9240 [inline] __se_sys_io_uring_enter+0x256/0x1d60 fs/io_uring.c:9182 io_link_timeout_fn() should put only one reference of the linked timeout request, however in case of racing with the master request's completion first io_req_complete() puts one and then io_put_req_deferred() is called.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 io_uring 模块的 io_link_timeout_fn() 方法中存在错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-47124
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-47124
请登录查看更多情报信息。
Other References for CVE-2021-47124 (5)
Same Patch Batch · Linux · 2024-03-15 · 26 CVEs total
| CVE-2021-47111 | 8.8 HIGH | xen-netback: take a reference to the RX task thread |
| CVE-2021-47131 | 8.1 HIGH | net/tls: Fix use-after-free after the TLS device goes down and up |
| CVE-2021-47135 | 7.8 HIGH | mt76: mt7921: fix possible AOOB issue in mt7921_mcu_tx_rate_report |
| CVE-2021-47112 | 7.8 HIGH | x86/kvm: Teardown PV features on boot CPU as well |
| CVE-2021-47129 | 7.8 HIGH | netfilter: nft_ct: skip expectations for confirmed conntrack |
| CVE-2021-47123 | 7.8 HIGH | io_uring: fix ltout double free on completion race |
| CVE-2021-47126 | 7.8 HIGH | ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions |
| CVE-2021-47132 | 7.5 HIGH | mptcp: fix sk_forward_memory corruption on retransmission |
| CVE-2021-47130 | 7.5 HIGH | nvmet: fix freeing unallocated p2pmem |
| CVE-2021-47109 | 7.5 HIGH | neighbour: allow NUD_NOARP entries to be forced GCed |
| CVE-2021-47113 | 7.1 HIGH | btrfs: abort in rename_exchange if we fail to insert the second ref |
| CVE-2021-47122 | net: caif: fix memory leak in caif_device_notify | |
| CVE-2021-47134 | efi/fdt: fix panic when no valid fdt found | |
| CVE-2021-47133 | HID: amd_sfh: Fix memory leak in amd_sfh_work | |
| CVE-2021-47128 | bpf, lockdown, audit: Fix buggy SELinux lockdown permission checks | |
| CVE-2021-47127 | ice: track AF_XDP ZC enabled queues in bitmap | |
| CVE-2021-47125 | sch_htb: fix refcount leak in htb_parent_to_leaf_offload | |
| CVE-2021-47121 | net: caif: fix memory leak in cfusbl_device_notify | |
| CVE-2021-47120 | HID: magicmouse: fix NULL-deref on disconnect | |
| CVE-2021-47119 | ext4: fix memory leak in ext4_fill_super |
Showing top 20 of 26 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off - CVE-2026-74578
crypto: algif_skcipher - force synchronous processing on tre - CVE-2026-74577
net: mpls: initialize rtm_tos in mpls_getroute() - CVE-2026-74576
mm/slab: prevent unbounded recursion in free path with new k - CVE-2026-74574
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev
Same vendor: Linux
- CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off - CVE-2026-74578
crypto: algif_skcipher - force synchronous processing on tre - CVE-2026-74577
net: mpls: initialize rtm_tos in mpls_getroute() - CVE-2026-74576
mm/slab: prevent unbounded recursion in free path with new k - CVE-2026-74574
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev
V. Comments for CVE-2021-47124
No comments yet