CVE-2021-47271— usb: cdnsp: Fix deadlock issue in cdnsp_thread_irq_handler
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于cdnsp_thread_irq_handler 中存在死锁问题。
Possible ATT&CK Techniques 1 AI
T1496 · Resource HijackingAffected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 3d82904559f4f5a2622db1b21de3edf2eded7664< ae746b6f4ce619cf4032fd798a232b010907a397 |
affected |
3d82904559f4f5a2622db1b21de3edf2eded7664< a9aecef198faae3240921b707bc09b602e966fce |
affected | ||
5.12 |
affected | ||
< 5.12 |
unaffected | ||
5.12.11≤ 5.12.* |
unaffected | ||
5.13≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-47271
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
usb: cdnsp: Fix deadlock issue in cdnsp_thread_irq_handler
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
usb: cdnsp: Fix deadlock issue in cdnsp_thread_irq_handler
Patch fixes the following critical issue caused by deadlock which has been
detected during testing NCM class:
smp: csd: Detected non-responsive CSD lock (#1) on CPU#0
smp: csd: CSD lock (#1) unresponsive.
....
RIP: 0010:native_queued_spin_lock_slowpath+0x61/0x1d0
RSP: 0018:ffffbc494011cde0 EFLAGS: 00000002
RAX: 0000000000000101 RBX: ffff9ee8116b4a68 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9ee8116b4658
RBP: ffffbc494011cde0 R08: 0000000000000001 R09: 0000000000000000
R10: ffff9ee8116b4670 R11: 0000000000000000 R12: ffff9ee8116b4658
R13: ffff9ee8116b4670 R14: 0000000000000246 R15: ffff9ee8116b4658
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7bcc41a830 CR3: 000000007a612003 CR4: 00000000001706e0
Call Trace:
<IRQ>
do_raw_spin_lock+0xc0/0xd0
_raw_spin_lock_irqsave+0x95/0xa0
cdnsp_gadget_ep_queue.cold+0x88/0x107 [cdnsp_udc_pci]
usb_ep_queue+0x35/0x110
eth_start_xmit+0x220/0x3d0 [u_ether]
ncm_tx_timeout+0x34/0x40 [usb_f_ncm]
? ncm_free_inst+0x50/0x50 [usb_f_ncm]
__hrtimer_run_queues+0xac/0x440
hrtimer_run_softirq+0x8c/0xb0
__do_softirq+0xcf/0x428
asm_call_irq_on_stack+0x12/0x20
</IRQ>
do_softirq_own_stack+0x61/0x70
irq_exit_rcu+0xc1/0xd0
sysvec_apic_timer_interrupt+0x52/0xb0
asm_sysvec_apic_timer_interrupt+0x12/0x20
RIP: 0010:do_raw_spin_trylock+0x18/0x40
RSP: 0018:ffffbc494138bda8 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff9ee8116b4658 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9ee8116b4658
RBP: ffffbc494138bda8 R08: 0000000000000001 R09: 0000000000000000
R10: ffff9ee8116b4670 R11: 0000000000000000 R12: ffff9ee8116b4658
R13: ffff9ee8116b4670 R14: ffff9ee7b5c73d80 R15: ffff9ee8116b4000
_raw_spin_lock+0x3d/0x70
? cdnsp_thread_irq_handler.cold+0x32/0x112c [cdnsp_udc_pci]
cdnsp_thread_irq_handler.cold+0x32/0x112c [cdnsp_udc_pci]
? cdnsp_remove_request+0x1f0/0x1f0 [cdnsp_udc_pci]
? cdnsp_thread_irq_handler+0x5/0xa0 [cdnsp_udc_pci]
? irq_thread+0xa0/0x1c0
irq_thread_fn+0x28/0x60
irq_thread+0x105/0x1c0
? __kthread_parkme+0x42/0x90
? irq_forced_thread_fn+0x90/0x90
? wake_threads_waitq+0x30/0x30
? irq_thread_check_affinity+0xe0/0xe0
kthread+0x12a/0x160
? kthread_park+0x90/0x90
ret_from_fork+0x22/0x30
The root cause of issue is spin_lock/spin_unlock instruction instead
spin_lock_irqsave/spin_lock_irqrestore in cdnsp_thread_irq_handler
function.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于cdnsp_thread_irq_handler 中存在死锁问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-47271
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-47271
请登录查看更多情报信息。
Other References for CVE-2021-47271 (2)
Same Patch Batch · Linux · 2024-05-21 · 361 CVEs total
| CVE-2023-52741 | 9.8 CRITICAL | cifs: Fix use-after-free in rdata->read_into_pages() |
| CVE-2021-47378 | 9.8 CRITICAL | nvme-rdma: destroy cm id before destroy qp to avoid use after free |
| CVE-2023-52755 | 9.8 CRITICAL | ksmbd: fix slab out of bounds write in smb_inherit_dacl() |
| CVE-2021-47427 | 9.8 CRITICAL | scsi: iscsi: Fix iscsi_task use after free |
| CVE-2023-52732 | 9.8 CRITICAL | ceph: blocklist the kclient when receiving corrupted snap trace |
| CVE-2021-47328 | 9.8 CRITICAL | scsi: iscsi: Fix conn use after free during resets |
| CVE-2021-47232 | 9.8 CRITICAL | can: j1939: fix Use-after-Free, hold skb ref while in use |
| CVE-2023-52846 | 8.8 HIGH | hsr: Prevent use after free in prp_create_tagged_frame() |
| CVE-2023-52769 | 8.8 HIGH | wifi: ath12k: fix htt mlo-offset event locking |
| CVE-2023-52790 | 8.8 HIGH | swiotlb: fix out-of-bounds TLB allocations with CONFIG_SWIOTLB_DYNAMIC |
| CVE-2021-47308 | 8.8 HIGH | scsi: libfc: Fix array index out of bound exception |
| CVE-2021-47390 | 8.8 HIGH | KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect() |
| CVE-2023-52801 | 8.8 HIGH | iommufd: Fix missing update of domains_itree after splitting iopt_area |
| CVE-2023-52776 | 8.8 HIGH | wifi: ath12k: fix dfs-radar and temperature event locking |
| CVE-2023-52798 | 8.8 HIGH | wifi: ath11k: fix dfs radar event locking |
| CVE-2021-47388 | 8.8 HIGH | mac80211: fix use-after-free in CCMP/GCMP RX |
| CVE-2023-52829 | 8.4 HIGH | wifi: ath12k: fix possible out-of-bound write in ath12k_wmi_ext_hal_reg_caps() |
| CVE-2021-47240 | 8.4 HIGH | net: qrtr: fix OOB Read in qrtr_endpoint_post |
| CVE-2021-47352 | 8.4 HIGH | virtio-net: Add validation for used length |
| CVE-2021-47244 | 8.2 HIGH | mptcp: Fix out of bounds when parsing TCP options |
Showing top 20 of 361 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
Same vendor: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
V. Comments for CVE-2021-47271
No comments yet